CVE-2024-37363

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. CWE-862 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source...

GHSA-3HFJ-QCVJ-4HX8 Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

Leantime has Missing Authorization Check for Host Parameter

Finding Description Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter. Impact By exploiting this vulnerability...

CVE-2024-5705

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. CWE-863 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0...

CVE-2024-6696

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses reads and/or writes to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad becau...

CVE-2024-37363

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. CWE-862 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source...

CVE-2024-37363

The CVE-2024-37363 entry concerns Hitachi Vantara Pentaho Business Analytics Server. Affected versions include before 10.2.0.0 and before 9.3.0.8, including 8.3.x. The root cause is an improper authorization check in the data source management service (CWE-862), allowing actors to access resource...

CVE-2024-5705

Hitachi Vantara Pentaho Business Analytics Server is affected by CVE-2024-5705 due to incorrect authorization checks. Affected versions include Hitachi Vantara Pentaho BA Server prior to 10.2.0.0 and 9.3.0.9, including 8.3.x, where modules are enabled by default that allow execution of system-lev...

CVE-2024-5705 Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. CWE-863 Hitachi Vantara Pentaho Business Analytics Server versions before...

Hitachi Vantara Pentaho Business Analytics Server 安全漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server that stems from the presence of an incorrect authorizati...

CVE-2025-25241

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-25241

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-23190

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-25241 Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-25241 Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)

Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23189

CVE-2025-23189 affects SAP NetWeaver and ABAP Platform (SDCCN) due to a missing authorization check in an RFC-enabled function module. An authenticated attacker could generate technical meta-data, with the documented impact limited to integrity (low), and no impact on confidentiality or availabil...

CVE-2025-23187

CVE-2025-23187 affects SAP NetWeaver and ABAP Platform (RFC-enabled function module in SDCCN). A missing authorization check allows unauthenticated attackers to generate technical metadata, causing low integrity impact and no confidentiality/availability impact. Public details come from NVD/SA so...

CVE-2025-23187 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability...