Vulnerabilidades em Hitachi Vantara

53 resultados
Análise Vexday

O portfólio de vulnerabilidades da Hitachi Vantara apresenta uma taxa de exploração ativa significativamente acima da média geral do catálogo CISA KEV — 8,4 vezes superior —, o que indica que, apesar do volume total relativamente baixo de 53 CVEs catalogadas, uma proporção elevada das falhas conhecidas já foi alvo de exploração real. A CVE mais crítica em atividade, CVE-2022-43769, registra EPSS de 0,9767, aproximando-se do valor máximo da escala e sinalizando altíssima probabilidade de exploração em ambiente produtivo. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), enquanto 3 vulnerabilidades possuem PoC pública disponível, reduzindo a barreira de entrada para agentes maliciosos. As 4 CVEs surgidas nos últimos 90 dias reforçam a necessidade de monitoramento contínuo, especialmente em ambientes onde a aplicação de patches pode ser operacionalmente complexa.

CVE-2022-3960MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') EPSS 0.5%CVE-2022-4770MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%CVE-2022-4769MEDIUMHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information EPSS 0.4%CVE-2025-24911MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2021-45446MEDIUM Pentaho Business Analytics Server - Exposure of Information Through Directory ListingEPSS 0.4%CVE-2025-24907MEDIUMHitachi Vantara Pentaho Data Integration & Analytics – Path TraversalEPSS 0.4%CVE-2025-24910MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2022-43772LOWHitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File EPSS 0.4%CVE-2025-11158CRITICALHitachi Vantara Pentaho Data Integration & Analytics - Missing AuthorizationEPSS 0.4%CVE-2023-1158MEDIUMHitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization EPSS 0.4%CVE-2024-28982HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-5617MEDIUMHitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive InformationEPSS 0.4%CVE-2025-9121HIGHHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted DataEPSS 0.4%CVE-2024-6696MEDIUMHitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access ControlEPSS 0.4%CVE-2022-4771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') EPSS 0.4%CVE-2022-3695MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation EPSS 0.4%CVE-2025-11159CRITICALHitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party ComponentEPSS 0.3%CVE-2024-37363MEDIUMHitachi Vantara Pentaho Business Analytics Server - Incorrect AuthorizationEPSS 0.3%CVE-2024-6697MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or PrivilegesEPSS 0.3%CVE-2021-45447HIGH Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear textEPSS 0.3%