Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new…Check if you run itEPSS 0.34%May 13, 2026
- Critical9.1Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published…Check if you run itEPSS 0.39%Mar 10, 2026
- Medium6.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot sCheck if you run itEPSS 0.44%Apr 16, 2025
- Medium4.9Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities.Check if you run itEPSS 0.45%Apr 16, 2025
- Medium4.9Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities.Check if you run itEPSS 0.43%Apr 16, 2025
- Medium4.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.Check if you run itEPSS 0.30%Apr 16, 2025
- Medium6.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot sCheck if you run itEPSS 0.50%Apr 16, 2025
- Critical9.1Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that mCheck if you run itEPSS 0.96%Apr 16, 2025
- Medium4.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.Check if you run itEPSS 0.30%Apr 16, 2025
- Medium6.1Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.Check if you run itEPSS 0.15%Apr 16, 2025
- Unknownhitachi vantara_pentaho Improper AuthenticationPatch nowKEVEPSS 51.65%May 2, 2023
- Critical9.8Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityPatch nowKEVEPSS 92.27%Apr 3, 2023
- High7.2Hitachi Vantara Pentaho BA Server Special Element Injection VulnerabilityPatch nowKEVEPSS 97.67%Apr 3, 2023
13 records · page 1 of 1
PreviousNext