Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2025-11159

Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2026-2253

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2026-2255

Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2026-2254

Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2025-11158

Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2025-9121

Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Business Analytics Server Vantara Pentaho Data Integration And Analytics
CVE-2025-0756

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

Overview   The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99)   Description   Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creation of platform data sources.   Impact   An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2025-9122

Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics
CVE-2023-5617

Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of Tomcat when a server error is encountered.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hitachi
Products
Vantara Pentaho Data Integration And Analytics