Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2975▼ 108 respecto a la semana anterior
Críticas / altas1449▲ 87 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior
35 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (8.8) | 0.56% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly perform an authorization check in the data source management service. | |
| Analizada | Crítica (9.8) | 92% | ⚠ Explotación activa💥 Exploit | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. | |
| Modificada | Alta (8.8) | 26% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. | |
| Modificada | Media (6.5) | 0.39% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. | |
| Modificada | Media (6.5) | 24% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds. | |
| Modificada | Media (6.3) | 0.45% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. | |
| Modificada | Alta (8.8) | 22% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. | |
| Analizada | Alta (7.2) | 98% | ⚠ Explotación activa💥 Exploit | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. | |
| Modificada | Alta (8.8) | 0.77% | — | Hitachivantara Pentaho Business Analytics | 28/11/2017 | 17/6/2026 | In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. | |
| Modificada | Media (5) | 2.3% | — | Pentaho Data IntegrationPentaho Business Analytics | 22/9/2015 | 17/6/2026 | The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain passwords and other… |