Vulnerabilities

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions.

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents.

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralize user-controllable input…

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.