security.vulnerabilities@hitachivantara.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security.vulnerabilities@hitachivantara.com
03
assessed vulnerabilities (55)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-108337US | — | — | ||
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used… | ||||
| CVE-2026-108336US | —OT elevated | — | ||
When the default self-signed certificate is used, an attacker could gain administrative access to the application.
The SSL certificate for the web interface is used to sign JWT… | ||||
| CVE-2026-108335US | — | — | ||
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.
There is no rate limiting on the a… | ||||
| CVE-2026-2255US | — | — | ||
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the C… | ||||
| CVE-2026-2254US | — | — | ||
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platf… | ||||
| CVE-2026-2253US | — | — | ||
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external… | ||||
| CVE-2025-11159US | high7.2 | — | ||
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection i… | ||||
| CVE-2025-11158US | —OT elevated | — | ||
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, all… | ||||
| CVE-2025-9122US | — | — | ||
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace whe… | ||||
| CVE-2025-9121US | — | — | ||
Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining… | ||||
| CVE-2025-24911US | — | — | ||
Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define a… | ||||
| CVE-2025-24910US | — | — | ||
Overview
XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define a… | ||||
| CVE-2025-24909US | — | — | ||
Overview
The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to othe… | ||||
| CVE-2025-24908US | — | — | ||
Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled tri… | ||||
| CVE-2025-24907US | — | — | ||
Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled tri… | ||||
| CVE-2025-0758US | — | — | ||
Overview
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732)
Descri… | ||||
| CVE-2025-0757US | — | — | ||
Overview
The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other… | ||||
| CVE-2025-0756US | — | — | ||
Overview
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resour… | ||||
| CVE-2024-6697US | — | — | ||
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to… | ||||
| CVE-2024-6696US | — | — | ||
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted a… | ||||