Pentaho BI Server Multiple Vulnerabilities

The host is running Pentaho BI Server and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodpentahobiservermultvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ Pentaho BI Server Multiple Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2011 SecPod,...

CVE-2009-5100

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

CVE-2009-5099

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

Cross site scripting

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

Session fixation

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

Default credentials

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

CVE-2009-5099

The Connected documents confirm CVE-2009-5099 affects Pentaho BI Server (1.7.0.1062 and earlier) via a Cross‑Site Scripting vulnerability in the ViewAction component, exploitable through the outputType parameter. Root cause: insufficient input validation/sanitization of the outputType parameter a...

CVE-2009-5100

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...

CVE-2009-5100

CVE-2009-5100 affects Pentaho BI Server 1.7.0.1062 and earlier, where web pages using a password field do not set autocomplete off. This may enable physically proximate attackers to obtain the password. The issue is described as a failure to disable autocomplete in login/password contexts, with a...

CVE-2009-5099

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5101

Pentaho BI Server 1.7.0.1062 and earlier is affected by CVE-2009-5101 due to including the JSESSIONID in the URL. The session ID can be obtained from session history, Referer headers, or by sniffing web traffic, enabling an attacker to hijack a user session. The CVSS base score is 5.0 (Medium) wi...

CVE-2009-5101: Exposure of Sensitive Information to an Unauthorized Actor

Pentaho BI Server 1.7.0.1062 and earlier includes the session ID JSESSIONID in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic...

CVE-2009-5099: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter...

PT-2011-1349

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier Description The issue allows physically proximate attackers to potentially obtain the password because the autocomplete tag is not set to off on web pages that use a password field...

PT-2011-1350

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier Description The issue allows attackers to obtain the session ID JSESSIONID from session history, referer headers, or by sniffing web traffic, as it is included in the URL. Recommendations For...

PT-2011-1348

Name of the Vulnerable Software and Affected Versions Pentaho BI Server versions 1.7.0.1062 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the outputType parameter. Recommendations For...

CVE-2009-5100: Exposure of Sensitive Information to an Unauthorized Actor

Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password...