# Hitachi Vantara Pentaho Business Analytics Server.

Every CVE that names Hitachi Vantara Pentaho Business Analytics Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-24911.md)
  `CVE-2025-24911` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-24910.md)
  `CVE-2025-24910` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2025-24909.md)
  `CVE-2025-24909` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.4 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2025-0757.md)
  `CVE-2025-0757` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.4 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource](https://agentprime.io/advisories/CVE-2025-0758.md)
  `CVE-2025-0758` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 6.1 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Broken access control
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization](https://agentprime.io/advisories/CVE-2024-37363.md)
  `CVE-2024-37363` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Broken access control
- [Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2024-37362.md)
  `CVE-2024-37362` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Hard-coded credentials
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges](https://agentprime.io/advisories/CVE-2024-6697.md)
  `CVE-2024-6697` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-280
- [Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control](https://agentprime.io/advisories/CVE-2024-6696.md)
  `CVE-2024-6696` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-1220
- [Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2024-37361.md)
  `CVE-2024-37361` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2025 · Tags: Insecure deserialization
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2024-37360.md)
  `CVE-2024-37360` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery](https://agentprime.io/advisories/CVE-2024-37359.md)
  `CVE-2024-37359` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 8.6 High · Not analysed yet · Published 19 Feb 2025 · Tags: Server-side request forgery (SSRF)
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization](https://agentprime.io/advisories/CVE-2024-5705.md)
  `CVE-2024-5705` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Feb 2025 · Tags: Broken access control
- [Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')](https://agentprime.io/advisories/CVE-2024-5706.md)
  `CVE-2024-5706` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-99
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2024-28984.md)
  `CVE-2024-28984` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2024-28983.md)
  `CVE-2024-28983` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2024 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2024-28982.md)
  `CVE-2024-28982` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 7.1 High · Not analysed yet · Published 26 Jun 2024 · Tags: Denial of service
- [Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format](https://agentprime.io/advisories/CVE-2023-2358.md)
  `CVE-2023-2358` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.3 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: CWE-257
- [Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2022-4815.md)
  `CVE-2022-4815` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.0 High · Not analysed yet · Published 24 May 2023 · Tags: Insecure deserialization
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization](https://agentprime.io/advisories/CVE-2023-1158.md)
  `CVE-2023-1158` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2023 · Tags: Broken access control
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization](https://agentprime.io/advisories/CVE-2022-43770.md)
  `CVE-2022-43770` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 5.4 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: Broken access control
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation](https://agentprime.io/advisories/CVE-2022-3695.md)
  `CVE-2022-3695` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 6.5 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2022-4771.md)
  `CVE-2022-4771` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 5.4 Medium · Not analysed yet · Published 3 Apr 2023 · Tags: Cross-site scripting (XSS)
- [Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information](https://agentprime.io/advisories/CVE-2022-4770.md)
  `CVE-2022-4770` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.3 Medium · Not analysed yet · Published 3 Apr 2023 · Tags: Information disclosure
- [Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information](https://agentprime.io/advisories/CVE-2022-4769.md)
  `CVE-2022-4769` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.3 Medium · Not analysed yet · Published 3 Apr 2023 · Tags: Information disclosure
- [Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2022-43772.md)
  `CVE-2022-43772` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 3.8 Low · Not analysed yet · Published 3 Apr 2023 · Tags: Information disclosure
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')](https://agentprime.io/advisories/CVE-2022-3960.md)
  `CVE-2022-3960` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2023 · Tags: Code injection
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2022-43941.md)
  `CVE-2022-43941` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 7.1 High · Not analysed yet · Published 3 Apr 2023 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')](https://agentprime.io/advisories/CVE-2022-43771.md)
  `CVE-2022-43771` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 6.5 Medium · EPSS 0.24 · Not analysed yet · Published 3 Apr 2023 · Tags: Path traversal
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization](https://agentprime.io/advisories/CVE-2022-43940.md)
  `CVE-2022-43940` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Not analysed yet · Published 3 Apr 2023 · Tags: Broken access control
- [Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions](https://agentprime.io/advisories/CVE-2022-43939.md)
  `CVE-2022-43939` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.6 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.92 · Not analysed yet · Published 3 Apr 2023 · Tags: CWE-647
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')](https://agentprime.io/advisories/CVE-2022-43938.md)
  `CVE-2022-43938` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 3 Apr 2023 · Tags: Code injection
- [Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource](https://agentprime.io/advisories/CVE-2022-43773.md)
  `CVE-2022-43773` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 3 Apr 2023 · Tags: Broken access control
- [Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)](https://agentprime.io/advisories/CVE-2022-43769.md)
  `CVE-2022-43769` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 3 Apr 2023 · Tags: Other injection
- [Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.](https://agentprime.io/advisories/CVE-2021-45448.md)
  `CVE-2021-45448` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2022 · Tags: Path traversal
- [Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text](https://agentprime.io/advisories/CVE-2021-45447.md)
  `CVE-2021-45447` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 7.7 High · Not analysed yet · Published 2 Nov 2022 · Tags: Weak cryptography or TLS
- [Pentaho Business Analytics Server - Exposure of Information Through Directory Listing](https://agentprime.io/advisories/CVE-2021-45446.md)
  `CVE-2021-45446` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 5.0 Medium · Not analysed yet · Published 2 Nov 2022 · Tags: CWE-548

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=hitachi-vantara-pentaho-business-analytics-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/hitachi-vantara-pentaho-business-analytics-server/>. Everything for agents: <https://agentprime.io/llms.txt>.