Pentaho Data Integration And Analytics
Approved changes feed: RSS · Atom
cpe:2.3:a:hitachi_vantara:pentaho_data_integration_and_analytics:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hitachi Vantara (e8dc481e-786f-581b-9bcc-69cd2ef2292d) |
|---|---|
| Product | Pentaho Data Integration And Analytics (512b79f6-c21e-563a-83f4-394b7fd181fd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-2255 |
vulnerable | 2026-06-08 07:55:16.786606 |
Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials
MEDIUM (4.3)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.
Published: 2026-05-27T02:51:31.793Z
Updated: 2026-05-27T18:00:39.061Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2254 |
vulnerable | 2026-06-08 07:55:16.786446 |
Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource
MEDIUM (6.3)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.
Published: 2026-05-27T02:46:36.132Z
Updated: 2026-05-27T18:00:14.572Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-2253 |
vulnerable | 2026-06-08 07:55:16.786111 |
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference
HIGH (7.7)
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
Published: 2026-05-27T02:54:25.857Z
Updated: 2026-05-27T18:00:59.490Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9122 |
vulnerable | 2026-06-08 07:45:21.754162 |
Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information
MEDIUM (5.3)
Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.
Published: 2025-12-15T22:50:42.466Z
Updated: 2025-12-16T15:10:16.460Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9121 |
vulnerable | 2026-06-08 07:45:21.753850 |
Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data
HIGH (8.8)
Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Published: 2025-12-15T22:53:57.465Z
Updated: 2026-02-26T16:07:40.029Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11159 |
vulnerable | 2026-06-08 07:02:28.165753 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11158 |
vulnerable | 2026-06-08 07:02:28.164690 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.