What’s Vulnerable › Products

Hitachi Vantara Pentaho Business Analytics Server vulnerabilities

28 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your Hitachi Vantara Pentaho Business Analytics Server version is affected

Exploited Hitachi Vantara Pentaho Business Analytics Server vulnerabilities

• CVE-2022-43939 — Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
• CVE-2022-43769 — Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Latest Hitachi Vantara Pentaho Business Analytics Server vulnerabilities

• CVE-2025-24911 — Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9)
• CVE-2025-24910 — Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9)
• CVE-2025-24909 — Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
• CVE-2025-0758 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (CVSS 6.1)
• CVE-2025-0757 — Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
• CVE-2024-6697 — Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges (CVSS 6.5)
• CVE-2024-6696 — Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control (CVSS 4.9)
• CVE-2024-37363 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 6.5)
• CVE-2024-37362 — Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 6.3)
• CVE-2024-37361 — Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 9.9)
• CVE-2024-5706 — Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 8.8)
• CVE-2024-5705 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8)
• CVE-2024-37360 — Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
• CVE-2024-37359 — Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery (CVSS 8.6)
• CVE-2023-1158 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 4.3)
• CVE-2022-4815 — Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 8.8)
• CVE-2022-4771 — Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 6.1)
• CVE-2022-4770 — Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3)
• CVE-2022-4769 — Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3)
• CVE-2022-43941 — Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 6.5)
• CVE-2022-43940 — Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8)
• CVE-2022-43939 — Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability (CVSS 9.8) — exploited
• CVE-2022-43938 — Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVSS 8.8)
• CVE-2022-43772 — Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File (CVSS 6.5)
• CVE-2022-43771 — Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 6.5)