https://vulnogram.org/ Most recent CVEs assigned by hitvan (hitvan). https://vulnogram.org/seaview/icons/hitvan.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-108337 https://vulnogram.org/CVE-2026-108337 An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by admini… High Wed, 14 Oct 2026 21:43:08 GMT https://vulnogram.org/CVE-2026-108336 https://vulnogram.org/CVE-2026-108336 When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When… Critical Network Exploitable Wed, 14 Oct 2026 21:41:40 GMT https://vulnogram.org/CVE-2026-108335 https://vulnogram.org/CVE-2026-108335 When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute fo… Critical Network Exploitable Wed, 14 Oct 2026 21:39:17 GMT https://vulnogram.org/CVE-2026-2253 https://vulnogram.org/CVE-2026-2253 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities. High Wed, 27 May 2026 02:54:25 GMT https://vulnogram.org/CVE-2026-2255 https://vulnogram.org/CVE-2026-2255 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, th… Medium Wed, 27 May 2026 02:51:31 GMT https://vulnogram.org/CVE-2026-2254 https://vulnogram.org/CVE-2026-2254 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications. Medium Wed, 27 May 2026 02:46:36 GMT https://vulnogram.org/CVE-2025-11159 https://vulnogram.org/CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator. Critical Wed, 13 May 2026 05:36:43 GMT https://vulnogram.org/CVE-2025-11158 https://vulnogram.org/CVE-2025-11158 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE. Critical Mon, 09 Mar 2026 22:12:51 GMT https://vulnogram.org/CVE-2025-9121 https://vulnogram.org/CVE-2025-9121 Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods. High Mon, 15 Dec 2025 22:53:57 GMT https://vulnogram.org/CVE-2025-9122 https://vulnogram.org/CVE-2025-9122 Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet. Medium Network Exploitable Mon, 15 Dec 2025 22:50:42 GMT https://vulnogram.org/CVE-2025-24907 https://vulnogram.org/CVE-2025-24907 Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that… Medium Wed, 16 Apr 2025 22:39:15 GMT https://vulnogram.org/CVE-2025-24911 https://vulnogram.org/CVE-2025-24911 Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the cont… Medium Wed, 16 Apr 2025 22:35:10 GMT https://vulnogram.org/CVE-2025-24910 https://vulnogram.org/CVE-2025-24910 Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the cont… Medium Wed, 16 Apr 2025 22:32:46 GMT https://vulnogram.org/CVE-2025-24909 https://vulnogram.org/CVE-2025-24909 Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server… Medium Wed, 16 Apr 2025 22:30:10 GMT https://vulnogram.org/CVE-2025-24908 https://vulnogram.org/CVE-2025-24908 Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that… Medium Wed, 16 Apr 2025 22:27:03 GMT https://vulnogram.org/CVE-2025-0756 https://vulnogram.org/CVE-2025-0756 Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Description Hit… Critical Wed, 16 Apr 2025 22:23:19 GMT https://vulnogram.org/CVE-2025-0757 https://vulnogram.org/CVE-2025-0757 Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server… Medium Wed, 16 Apr 2025 22:18:19 GMT https://vulnogram.org/CVE-2025-0758 https://vulnogram.org/CVE-2025-0758 Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2… Medium Wed, 16 Apr 2025 22:12:29 GMT https://vulnogram.org/CVE-2024-37363 https://vulnogram.org/CVE-2024-37363 The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly… Medium Wed, 19 Feb 2025 23:40:10 GMT https://vulnogram.org/CVE-2024-37362 https://vulnogram.org/CVE-2024-37362 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and… Medium Wed, 19 Feb 2025 23:34:29 GMT https://vulnogram.org/CVE-2024-6697 https://vulnogram.org/CVE-2024-6697 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid… Medium Wed, 19 Feb 2025 23:32:18 GMT https://vulnogram.org/CVE-2024-6696 https://vulnogram.org/CVE-2024-6696 The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity,… Medium Wed, 19 Feb 2025 23:29:43 GMT https://vulnogram.org/CVE-2024-37361 https://vulnogram.org/CVE-2024-37361 The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted… Critical Wed, 19 Feb 2025 23:25:33 GMT https://vulnogram.org/CVE-2024-37360 https://vulnogram.org/CVE-2024-37360 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output… Medium Wed, 19 Feb 2025 23:01:41 GMT https://vulnogram.org/CVE-2024-37359 https://vulnogram.org/CVE-2024-37359 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Busi… High Network Exploitable Wed, 19 Feb 2025 22:58:57 GMT https://vulnogram.org/CVE-2024-5705 https://vulnogram.org/CVE-2024-5705 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho… High Wed, 19 Feb 2025 22:55:08 GMT https://vulnogram.org/CVE-2024-5706 https://vulnogram.org/CVE-2024-5706 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho… High Wed, 19 Feb 2025 22:49:46 GMT https://vulnogram.org/CVE-2024-28981 https://vulnogram.org/CVE-2024-28981 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields. High Wed, 11 Sep 2024 23:27:42 GMT https://vulnogram.org/CVE-2024-28984 https://vulnogram.org/CVE-2024-28984 Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface. High Network Exploitable Wed, 26 Jun 2024 22:41:57 GMT https://vulnogram.org/CVE-2024-28983 https://vulnogram.org/CVE-2024-28983 Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface. High Network Exploitable Wed, 26 Jun 2024 22:40:15 GMT https://vulnogram.org/CVE-2024-28982 https://vulnogram.org/CVE-2024-28982 Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference. High Wed, 26 Jun 2024 22:37:01 GMT https://vulnogram.org/CVE-2023-5617 https://vulnogram.org/CVE-2023-5617 Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered. Medium Network Exploitable Wed, 28 Feb 2024 22:30:40 GMT https://vulnogram.org/CVE-2023-3517 https://vulnogram.org/CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not restrict JNDI identifiers during the creation of XActions, allowing control of system level data sources. High Tue, 12 Dec 2023 22:28:08 GMT https://vulnogram.org/CVE-2023-6538 https://vulnogram.org/CVE-2023-6538 SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, tha… High Mon, 11 Dec 2023 17:54:11 GMT https://vulnogram.org/CVE-2023-5808 https://vulnogram.org/CVE-2023-5808 SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would norma… High Mon, 04 Dec 2023 23:53:33 GMT https://vulnogram.org/CVE-2023-2358 https://vulnogram.org/CVE-2023-2358 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in plaintext. Medium Tue, 26 Sep 2023 21:34:06 GMT https://vulnogram.org/CVE-2022-4815 https://vulnogram.org/CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. High Wed, 24 May 2023 21:30:37 GMT https://vulnogram.org/CVE-2023-1158 https://vulnogram.org/CVE-2023-1158 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. Medium Wed, 24 May 2023 21:26:53 GMT https://vulnogram.org/CVE-2022-43770 https://vulnogram.org/CVE-2022-43770 Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API. Medium Tue, 11 Apr 2023 15:48:16 GMT https://vulnogram.org/CVE-2022-3695 https://vulnogram.org/CVE-2022-3695 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard when the CDE plugin is present. Medium Network Exploitable Tue, 11 Apr 2023 15:45:03 GMT https://vulnogram.org/CVE-2022-4771 https://vulnogram.org/CVE-2022-4771 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables. Medium Network Exploitable Mon, 03 Apr 2023 18:58:44 GMT https://vulnogram.org/CVE-2022-4770 https://vulnogram.org/CVE-2022-4770 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). Medium Mon, 03 Apr 2023 18:56:17 GMT https://vulnogram.org/CVE-2022-4769 https://vulnogram.org/CVE-2022-4769 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. Medium Mon, 03 Apr 2023 18:53:51 GMT https://vulnogram.org/CVE-2022-43772 https://vulnogram.org/CVE-2022-43772 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. Low Mon, 03 Apr 2023 18:50:58 GMT https://vulnogram.org/CVE-2022-3960 https://vulnogram.org/CVE-2022-3960 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. Medium Mon, 03 Apr 2023 18:48:00 GMT https://vulnogram.org/CVE-2022-43941 https://vulnogram.org/CVE-2022-43941 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. High Mon, 03 Apr 2023 18:44:41 GMT https://vulnogram.org/CVE-2022-43771 https://vulnogram.org/CVE-2022-43771 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out… Medium Mon, 03 Apr 2023 18:40:01 GMT https://vulnogram.org/CVE-2022-43940 https://vulnogram.org/CVE-2022-43940 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. High Mon, 03 Apr 2023 18:25:33 GMT https://vulnogram.org/CVE-2022-43939 https://vulnogram.org/CVE-2022-43939 Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. High Known Exploited Network Exploitable Mon, 03 Apr 2023 18:10:32 GMT https://vulnogram.org/CVE-2022-43938 https://vulnogram.org/CVE-2022-43938 Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. High Mon, 03 Apr 2023 18:06:54 GMT