Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2703▼ 615 respecto a la semana anterior
Críticas / altas1293▼ 208 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)291▼ 219 respecto a la semana anterior
33 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Crítica (9.8) | 92% | ⚠ Explotación activa💥 Exploit | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. | |
| Modificada | Alta (8.8) | 26% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. | |
| Modificada | Media (6.5) | 0.39% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. | |
| Modificada | Media (6.5) | 24% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds. | |
| Modificada | Media (6.3) | 0.45% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. | |
| Modificada | Alta (8.8) | 22% | — | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. | |
| Analizada | Alta (7.2) | 98% | ⚠ Explotación activa💥 Exploit | Hitachi Vantara Pentaho Business Analytics Server | 3/4/2023 | 17/6/2026 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. | |
| Modificada | Alta (8.8) | 0.77% | — | Hitachivantara Pentaho Business Analytics | 28/11/2017 | 17/6/2026 | In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. |