Vulnerabilities

TI-2015-05788 CVE-2015-6940 · GHSA-p2w4-6crq-85gc

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x…

LOW 27

The GetResource servlet in Pentaho Business Analytics (BA) Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration (PDI) Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in t…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02295 Published 2015-09-22 No fix listed CWE-200

TI-2009-04853 CVE-2009-5101 · GHSA-78rm-x38x-8fwp

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL…

LOW 25

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01135 Published 2011-09-13 No fix listed CWE-200

TI-2009-04852 CVE-2009-5100 · GHSA-88m9-g755-gjf2

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web…

LOW 11

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00409 Published 2011-09-13 No fix listed CWE-200

TI-2009-04851 CVE-2009-5099 · GHSA-jh75-h74m-97h7

Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062…

LOW 22

Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01128 Published 2011-09-13 No fix listed CWE-79

TI-2006-05479 CVE-2006-5675 · GHSA-6wgh-w8jx-43rw

Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before…

MEDIUM 46

Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before 1.2 RC3 (1.2.0.470-RC3) have unknown impact and attack vectors, related to "MySQL Scripts need changes for security," possibly SQL i…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01507 Published 2006-11-03 No fix listed