Security Bulletin: Vulnerability from log4j-1.2.16.jar affect IBM Operations Analytics - Log Analysis (CVE-2023-26464)

Summary log4j-1.2.16.jar is vulnerable and it is shipped in Log Analysis. The fix includes Apache Log4j core 2.17.1 Vulnerability Details CVEID:CVE-2023-26464 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by a flaw when using the Chainsaw or SocketAppender components. By...

IBM Cognos Analytics Cross-Site Scripting Vulnerability (CNVD-2023-41887)

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A cross-site scripti...

WordPress plugin Slimstat Analytics 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-14654 · WordPress · Slimstat Analytics

Name of the Vulnerable Software and Affected Versions: Slimstat Analytics plugin versions = 5.0.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into a website, affecting user...

CVE-2023-1158

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list...

CVE-2022-4815

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods...

CVE-2023-1158

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list...

Design/Logic Flaw

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods...

Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list...

Security Bulletin: IBM Planning Analytics Workspace has addressed a vulnerability in SnakeYaml (CVE-2022-1471)

Summary IBM Planning Analytics Workspace is vulnerable to a Remote Code Execution RCE in SnakeYaml. SnakeYaml has been upgraded in IBM Planning Analytics Workspace. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote authenticated attacker to execute arbitrary co...

CVE-2022-4815

Hitachi Vantara Pentaho Business Analytics Server is affected by CVE-2022-4815 due to deserialization of untrusted JSON data without constraining the parser to approved classes/methods. Affected versions include Pentaho BA Server prior to 9.4.0.1, prior to 9.3.0.3, and 8.3.x. The issue originates...

CVE-2022-4815 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods...

CVE-2023-1158 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list...

CVE-2023-1158

Hitachi Vantara Pentaho Business Analytics Server is affected by CVE-2023-1158 due to improper/incorrect authorization that exposes dashboard prompts to users not on the authorization list. Affected versions are before 9.4.0.1 and before 9.3.0.3, including 8.3.x. Impact: potential disclosure of d...

CVE-2022-30025

SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...

CVE-2022-30025

SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...

Sql injection

SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...

CVE-2022-30025

CVE-2022-30025 involves an SQL injection in tCredence Analytics iDEAL Wealth and Funds (version 1.0). The vulnerability exposes the POST parameter named v in the URL path "/Framewrk/Home.jsp" to authenticated remote attackers, enabling payload injection and potential data disclosure (as indicated...

CVE-2022-30025

SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...

CVE-2022-30025

SQL injection in "/Framewrk/Home.jsp" file POST method in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows authenticated remote attackers to inject payload via "v" parameter...