Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

44 results

May 27, 2026Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plaiCVE-2026-2255 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
May 27, 2026Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoiCVE-2026-2254 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.3
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
May 27, 2026Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fromCVE-2026-2253 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 7.7
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
May 13, 2026Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution wheCVE-2025-11159 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comCritical 9.1
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Mar 10, 2026Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports pubCVE-2025-11158 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comCritical 9.1
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com ox.security
Dec 15, 2025Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full seCVE-2025-9122 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.3
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
Product
Pentaho Data Integration and Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software dCVE-2024-37360 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.4
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Sep 11, 2024Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadataCVE-2024-28981 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.5
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Jun 26, 2024Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the AnalyCVE-2024-28984 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Jun 26, 2024Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the AnalyCVE-2024-28983 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Jun 26, 2024Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of theCVE-2024-28982 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 7.1
Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Feb 28, 2024 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a servCVE-2023-5617 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.3
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Dec 12, 2023 Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creatiCVE-2023-3517 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.5
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Sep 27, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plCVE-2023-2358 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
May 24, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of thCVE-2023-1158 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
May 24, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining theCVE-2022-4815 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 11, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboCVE-2022-43770 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.4
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 11, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard whenCVE-2022-3695 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard when the CDE plugin is present.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the PentaCVE-2022-4771 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5.4
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error meCVE-2022-4770 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploadeCVE-2022-4769 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.3
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoCVE-2022-43941 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 7.1
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the dCVE-2022-43940 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityCVE-2022-43939 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.6
Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scriptiCVE-2022-43938 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and passworCVE-2022-43772 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comLow 3.8
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service CVE-2022-43771 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scriptiCVE-2022-3960 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.3
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configurCVE-2022-43773 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Apr 3, 2023Hitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityCVE-2022-43769 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comExploitedHigh 8.8
Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution.
Product
Pentaho Business Analytics (BA) Server
On CISA’s list since
Mar 3, 2025 (federal fix deadline Mar 24, 2025)
What to do
Attackers are using this now. Install Hitachi Vantara’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.pentaho.com
Nov 2, 2022 Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwCVE-2021-45447 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 7.7
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text. The transmission of sensitive data in clear text allows unauthorized actors with access to the network to sniff and obtain sensitive information that can be later used to gain unauthorized access.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Nov 2, 2022A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the childreCVE-2021-45446 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 5
A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder. This directory listing provides an attacker with the complete index of all the resources located inside the directory.
Product
Pentaho Business Analytics Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com support.pentaho.com
Nov 7, 2021UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to uploCVE-2021-34685 · Other software · Hitachi · reported by MITRELow 2.7
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .jsp file is not allowed, but a .jsp. file is allowed (and leads to remote code execution).
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Nov 7, 2021Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retriCVE-2021-34684 · Other software · Hitachi · reported by MITRECritical 9.8
Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as demonstrated by an api/repos/dashboards/editor URI.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Nov 7, 2021An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.CVE-2021-31602 · Other software · Hitachi · reported by MITREMedium 5.3
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the applicationContext-spring-security.xml file. The default configuration allows an unauthenticated user with no previous knowledge of the platform settings to extract pieces of information without possessing valid credentials.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Nov 7, 2021An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.CVE-2021-31601 · Other software · Hitachi · reported by MITREHigh 7.1
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Nov 7, 2021An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.CVE-2021-31600 · Other software · Hitachi · reported by MITREMedium 4.3
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all valid usernames.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Nov 7, 2021An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.CVE-2021-31599 · Other software · Hitachi · reported by MITREHigh 8.8
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex reports. An authenticated user can run arbitrary code.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com hitachi.com
Jan 29, 2021The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote CVE-2020-24670 · Other software · Hitachi · reported by MITREMedium 5.4
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi.com accenture.com
Jan 29, 2021The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remoCVE-2020-24669 · Other software · Hitachi · reported by MITREMedium 5.4
The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi.com accenture.com
Jan 29, 2021The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote userCVE-2020-24666 · Other software · Hitachi · reported by MITREMedium 5.4
The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi.com accenture.com
Jan 29, 2021The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remoteCVE-2020-24665 · Other software · Hitachi · reported by MITREMedium 6.5
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi.com accenture.com
Jan 29, 2021The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote CVE-2020-24664 · Other software · Hitachi · reported by MITREMedium 5.4
The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.
Product
Vantara Pentaho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com accenture.com
Nov 27, 2017In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.CVE-2016-10701 · Other software · Hitachivantara · reported by MITREHigh 8.8
In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.
Product
Pentaho Business Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.pentaho.com jira.pentaho.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.