CVE-2026-2255 | Medium | 4.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in pla… |
CVE-2026-2254 | Medium | 6.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpo… |
CVE-2026-2253 | High | 7.7 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers fro… |
CVE-2025-11159 | Critical | 9.1 | 2026-05-13 | Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution wh… |
CVE-2025-11158 | Critical | 9.1 | 2026-03-10 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports pu… |
CVE-2025-9122 | Medium | 5.3 | 2025-12-15 | Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full s… |
CVE-2025-9121 | High | 8.8 | 2025-12-15 | Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data… |
CVE-2025-24911 | Medium | 4.9 | 2025-04-16 | Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24910 | Medium | 4.9 | 2025-04-16 | Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24909 | Medium | 4.4 | 2025-04-16 | Overview
The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page t… |
CVE-2025-24908 | Medium | 6.8 | 2025-04-16 | Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2025-24907 | Medium | 6.8 | 2025-04-16 | Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2025-0758 | Medium | 6.1 | 2025-04-16 | Overview
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors… |
CVE-2025-0757 | Medium | 4.4 | 2025-04-16 | Overview
The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page th… |
CVE-2025-0756 | Critical | 9.1 | 2025-04-16 | Overview
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an id… |
CVE-2024-6697 | Medium | 6.5 | 2025-02-20 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions… |
CVE-2024-6696 | Medium | 4.9 | 2025-02-20 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sy… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862)
Hitachi Vantara Pentaho… |
CVE-2024-37362 | Medium | 6.3 | 2025-02-20 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (… |
CVE-2024-37361 | Critical | 9.9 | 2025-02-20 | The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)
Hitachi Vantara Pentaho Bus… |
CVE-2024-5706 | High | 8.8 | 2025-02-19 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a res… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2024-37360 | Medium | 4.4 | 2025-02-19 | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software… |
CVE-2024-37359 | High | 8.6 | 2025-02-19 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that th… |
CVE-2024-28981 | High | 8.5 | 2024-09-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadat… |
CVE-2024-28984 | High | 8.8 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Anal… |
CVE-2024-28983 | High | 8.8 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Anal… |
CVE-2024-28982 | High | 7.1 | 2024-06-26 | Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of th… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 |
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |
CVE-2023-3517 | High | 8.5 | 2023-12-12 |
Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including
8.3.x does not restrict JNDI identifiers during the creat… |
CVE-2023-6538 | High | 7.6 | 2023-12-11 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or co… |
CVE-2023-5808 | High | 7.6 | 2023-12-05 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrat… |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2023-1158 | Medium | 4.3 | 2023-05-24 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of t… |
CVE-2022-4815 | High | 8.0 | 2023-05-24 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining th… |
CVE-2022-43770 | Medium | 5.4 | 2023-04-11 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashb… |
CVE-2022-3695 | Medium | 6.5 | 2023-04-11 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard whe… |
CVE-2022-4771 | Medium | 5.4 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pent… |
CVE-2022-4770 | Medium | 4.3 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error m… |
CVE-2022-4769 | Medium | 4.3 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is upload… |
CVE-2022-43941 | High | 7.1 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endp… |
CVE-2022-43940 | High | 8.8 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the… |
CVE-2022-43939 | High | 8.6 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs w… |
CVE-2022-43938 | High | 8.8 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable script… |
CVE-2022-43772 | Low | 3.8 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and passwo… |
CVE-2022-43771 | Medium | 6.5 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service… |
CVE-2022-3960 | Medium | 6.3 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable script… |
CVE-2022-43773 | High | 8.8 | 2023-04-03 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configu… |
CVE-2022-43769 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values whic… |
CVE-2021-45448 | High | 7.1 | 2022-11-02 | Pentaho Business Analytics
Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho
Analyzer plugin exposes a service endpoint for templates which allow… |
CVE-2021-45447 | High | 7.7 | 2022-11-02 |
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and
8.3.0.25 with the Data Lineage feature enabled transmits database pass… |
CVE-2021-45446 | Medium | 5.0 | 2022-11-02 | A vulnerability in
Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and
8.3.0.25 does not cascade the hidden property to the childr… |
CVE-2021-28052 | High | 7.5 | 2022-09-26 | A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized a… |