Hitachi Vantara Pentaho Business Analytics Server

• CVE-2022-43939 High 8.6 Exploited Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions 92.3%
• CVE-2022-43769 High 8.8 Exploited Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) 97.7%
• CVE-2025-24911 Medium 4.9 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference 0.4%
• CVE-2025-24910 Medium 4.9 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference 0.4%
• CVE-2025-24909 Medium 4.4 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.3%
• CVE-2025-0757 Medium 4.4 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.3%
• CVE-2025-0758 Medium 6.1 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource 0.1%
• CVE-2024-37363 Medium 6.5 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 0.3%
• CVE-2024-37362 Medium 6.3 Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials 0.3%
• CVE-2024-6697 Medium 6.5 Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges 0.3%
• CVE-2024-6696 Medium 4.9 Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control 0.4%
• CVE-2024-37361 Critical 9.9 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data 0.5%
• CVE-2024-37360 Medium 4.4 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.3%
• CVE-2024-37359 High 8.6 Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery 0.5%
• CVE-2024-5705 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 0.5%
• CVE-2024-5706 High 8.8 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') 0.7%
• CVE-2024-28984 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.3%
• CVE-2024-28983 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.3%
• CVE-2024-28982 High 7.1 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference 0.4%
• CVE-2023-2358 Medium 4.3 Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format 0.3%
• CVE-2022-4815 High 8.0 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data 0.6%
• CVE-2023-1158 Medium 4.3 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 0.4%
• CVE-2022-43770 Medium 5.4 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 0.5%
• CVE-2022-3695 Medium 6.5 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation 0.4%
• CVE-2022-4771 Medium 5.4 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 0.4%
• CVE-2022-4770 Medium 4.3 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information 0.4%
• CVE-2022-4769 Medium 4.3 Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information 0.4%
• CVE-2022-43772 Low 3.8 Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File 0.4%
• CVE-2022-3960 Medium 6.3 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') 0.5%
• CVE-2022-43941 High 7.1 Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference 0.5%
• CVE-2022-43771 Medium 6.5 Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 23.9%
• CVE-2022-43940 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 0.6%
• CVE-2022-43938 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') 26.4%
• CVE-2022-43773 High 8.8 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource 22.2%
• CVE-2021-45448 High 7.1 Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds. 0.7%
• CVE-2021-45447 High 7.7 Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text 0.4%
• CVE-2021-45446 Medium 5.0 Pentaho Business Analytics Server - Exposure of Information Through Directory Listing 0.5%