Pentaho BI Server Multiple Vulnerabilities

The host is running Pentaho BI Server and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodpentahobiservermultvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ Pentaho BI Server Multiple Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2011 SecPod,...

CVE-2009-5100

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

CVE-2009-5099

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

Default credentials

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

Session fixation

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

Cross site scripting

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

CVE-2009-5099

The Connected documents confirm CVE-2009-5099 affects Pentaho BI Server (1.7.0.1062 and earlier) via a Cross‑Site Scripting vulnerability in the ViewAction component, exploitable through the outputType parameter. Root cause: insufficient input validation/sanitization of the outputType parameter a...

CVE-2009-5100

CVE-2009-5100 affects Pentaho BI Server 1.7.0.1062 and earlier, where web pages using a password field do not set autocomplete off. This may enable physically proximate attackers to obtain the password. The issue is described as a failure to disable autocomplete in login/password contexts, with a...

CVE-2009-5099

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

CVE-2009-5100

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier is affected by CVE-2009-5101 due to including the JSESSIONID in the URL. The session ID can be obtained from session history, Referer headers, or by sniffing web traffic, enabling an attacker to hijack a user session. The CVSS base score is 5.0 (Medium) wi...

Fedora Update for couchdb FEDORA-2011-7232

Check for the Version of couchdb OpenVAS Vulnerability Test Fedora Update for couchdb FEDORA-2011-7232 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Oracle BI Publisher Enterprise Detection

The remote web server hosts Oracle BI Publisher Enterprise, a report publishing system written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid53258; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...

CVE-2010-4427

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.4.0, 10.1.3.4.1, and 11.1.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Web Server...

CVE-2010-4425

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.3.2, 10.1.3.4.0, and 10.1.3.4.1 allows remote authenticated users to affect integrity via unknown vectors related to Web Server...

Design/Logic Flaw

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.4.0, 10.1.3.4.1, and 11.1.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Web Server...

Design/Logic Flaw

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.3.2, 10.1.3.4.0, and 10.1.3.4.1 allows remote authenticated users to affect integrity via unknown vectors related to Web Server...

CVE-2010-4427

Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.4.0, 10.1.3.4.1, and 11.1.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Web Server...