Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Hitachi Vantara Pentaho Data Integration & Analytics 10.2.0.2 Clear all filters
TI-2025-18609 CVE-2025-24907 · GHSA-2fg7-5jv3-82cc

Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Priority LOW 30

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a lo…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00436 Published 2025-04-16 Fixed in 10.2.0.2 CWE-35
TI-2025-18610 CVE-2025-24908 · GHSA-485r-phmq-84vw

Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Priority LOW 31

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a lo…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00502 Published 2025-04-16 Fixed in 10.2.0.2 CWE-35
TI-2025-00644 CVE-2025-0756 · GHSA-6hg2-95ww-whj9

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

Priority MEDIUM 43

Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of con…

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00957 Published 2025-04-16 Fixed in 10.2.0.2 CWE-99