https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:46:18 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-02158 bdu:2025-02158 https://cve.radiocsirt.org/vuln/bdu:2025-02158 https://cve.radiocsirt.org/vuln/euvd-2026-218491 EUVD-2026-218491 https://cve.radiocsirt.org/vuln/euvd-2026-218491 https://cve.radiocsirt.org/vuln/fkie_cve-2024-37360 <p>Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)</p> <p>Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.</p> <p>Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim&#39;s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.</p> <p>Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)</p> <p>Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.</p> <p>Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim&#39;s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-37360 https://cve.radiocsirt.org/vuln/ghsa-h4wq-hxvv-x8qq <p>Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)</p> <p>Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.</p> <p>Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim&#39;s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.</p> <p>Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;)</p> <p>The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)</p> <p>Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.</p> <p>Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim&#39;s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.</p> https://cve.radiocsirt.org/vuln/ghsa-h4wq-hxvv-x8qq