Hitachi Vantara Pentaho Data Integration & Analytics
15 CVEs affecting Hitachi Vantara Pentaho Data Integration & Analytics. Latest disclosed: 2025-04-16. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37361 | Critical | 9.9 | 2025-02-20 | The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Bus… |
CVE-2025-0756 | Critical | 9.1 | 2025-04-16 | Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an id… |
CVE-2024-5706 | High | 8.8 | 2025-02-19 | The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a res… |
CVE-2024-5705 | High | 8.8 | 2025-02-19 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This… |
CVE-2024-37359 | High | 8.6 | 2025-02-19 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that th… |
CVE-2024-28981 | High | 8.5 | 2024-09-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadat… |
CVE-2023-3517 | High | 8.5 | 2023-12-12 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creat… |
CVE-2025-24908 | Medium | 6.8 | 2025-04-16 | Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2025-24907 | Medium | 6.8 | 2025-04-16 | Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '… |
CVE-2024-6697 | Medium | 6.5 | 2025-02-20 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions… |
CVE-2024-37363 | Medium | 6.5 | 2025-02-20 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho… |
CVE-2024-37362 | Medium | 6.3 | 2025-02-20 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (… |
CVE-2023-5617 | Medium | 5.3 | 2024-02-28 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a ser… |
CVE-2024-6696 | Medium | 4.9 | 2025-02-20 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sy… |
CVE-2024-37360 | Medium | 4.4 | 2025-02-19 | Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software… |