Filtered by vendor Hitachi Subscriptions
Filtered by product Vantara Pentaho Business Analytics Server Subscriptions
Total 14 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-1158 1 Hitachi 2 Vantara Pentaho, Vantara Pentaho Business Analytics Server 2024-11-21 4.3 Medium
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. 
CVE-2022-4815 1 Hitachi 2 Vantara Pentaho, Vantara Pentaho Business Analytics Server 2024-11-21 8 High
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 
CVE-2022-4771 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 5.4 Medium
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables. 
CVE-2022-4770 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 4.3 Medium
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt). 
CVE-2022-4769 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 4.3 Medium
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name. 
CVE-2022-43941 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 7.1 High
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 
CVE-2022-43940 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 8.8 High
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. 
CVE-2022-43939 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 8.6 High
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. 
CVE-2022-43938 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 8.8 High
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. 
CVE-2022-43773 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 8.8 High
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. 
CVE-2022-43772 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 3.8 Low
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. 
CVE-2022-43771 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 6.5 Medium
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  
CVE-2022-43769 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 8.8 High
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. 
CVE-2022-3960 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 6.3 Medium
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin.