Vulnerabilities > Hitachi > Vantara Pentaho > High

DATE CVE VULNERABILITY TITLE RISK
2023-05-24 CVE-2022-4815 Deserialization of Untrusted Data vulnerability in Hitachi products
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 
network
low complexity
hitachi CWE-502
8.8
2022-11-02 CVE-2021-45446 Improper Preservation of Permissions vulnerability in Hitachi Vantara Pentaho 8.3.0.0/8.3.0.25/8.3.0.9
A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden property to the children of the Home folder.  This directory listing provides an attacker with the complete index of all the resources located inside the directory.
network
low complexity
hitachi CWE-281
7.5
2022-11-02 CVE-2021-45447 Cleartext Transmission of Sensitive Information vulnerability in Hitachi Vantara Pentaho 8.3.0.0/8.3.0.25/8.3.0.9
Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.2 and 8.3.0.25 with the Data Lineage feature enabled transmits database passwords in clear text.   The transmission of sensitive data in clear text allows unauthorized actors with access to the network to sniff and obtain sensitive information that can be later used to gain unauthorized access.
network
low complexity
hitachi CWE-319
7.5
2021-11-08 CVE-2021-31599 Unrestricted Upload of File with Dangerous Type vulnerability in Hitachi products
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
network
low complexity
hitachi CWE-434
8.8
2021-11-08 CVE-2021-31602 Improper Authentication vulnerability in Hitachi products
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
network
low complexity
hitachi CWE-287
7.5
2021-11-08 CVE-2021-34685 Unrestricted Upload of File with Dangerous Type vulnerability in Hitachi Vantara Pentaho
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types.
network
low complexity
hitachi CWE-434
7.2