10543 matches found
CVE-2020-24670
CVE-2020-24670 concerns the Dashboard Editor in Hitachi Vantara Pentaho (7.x–8.x). The vulnerability is a reflected Cross-site Scripting flaw in the dashboardXml parameter’s type attribute, exploitable by an authenticated remote user to execute arbitrary JavaScript. The issue is mitigated by upda...
CVE-2020-24670
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter...
CVE-2020-24665
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...
CVE-2020-24665
The CVE-2020-24665 issue affects Hitachi Vantara Pentaho Dashboard Editor in the 7.x–8.x line. It is an XML Entity Expansion (XXE) injection via the dashboardXml parameter that enables an authenticated remote user to trigger a denial of service (DoS) . The root cause is the processing of external...
GHSA-2HW7-MXVJ-M455 Path traversal in Node-RED-Dashboard
In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows uibase/js/..%2f directory traversal to read files...
Path traversal in Node-RED-Dashboard
In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows uibase/js/..%2f directory traversal to read files...
@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.1.4), @ia-cloud/node-red-dashboard-2-ia-cloud (>=1.0.0, <=1.0.1) +5 more potentially affected by CVE-2021-3223 via node-red-dashboard (>=2.3.11, <=2.17.0)
node-red-dashboard NPM version =2.3.11, =0.0.1, =1.0.0, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2021-3223 Source advisory: GHSA-2HW7-MXVJ-M455...
@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.1.4), @ia-cloud/node-red-dashboard-2-ia-cloud (>=1.0.0, <=1.0.1) +5 more potentially affected by CVE-2021-3223 via node-red-dashboard (>=2.3.11, <=2.17.0)
node-red-dashboard NPM version =2.3.11, =0.0.1, =1.0.0, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2021-3223 Source advisory: OSV:GHSA-2HW7-MXVJ-M455...
Hitachi Vantara Pentaho 跨站脚本漏洞
Pentaho is a Business Intelligence BI software that provides data integration, OLAP services, reporting, information dashboards, data mining, and Extract, Transform, Load ETL capabilities. A reflected cross-site scripting vulnerability exists in the 'type' attribute of the 'dashboardXml' paramete...
CVE-2020-24665: Improper Restriction of Recursive Entity References in DTDs
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service DoS condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in ...
CVE-2020-24664: Improper Neutralization of Input During Web Page Generation
The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter...
PT-2021-11062
Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x Description: The Dashboard Editor in Hitachi Vantara Pentaho contains a reflected Cross-site scripting issue, allowing authenticated remote users to execute arbitrary JavaScript code. The...
PT-2021-11057
Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x before 7.1.0.25 Hitachi Vantara Pentaho versions 8.x before 8.2.0.6 Hitachi Vantara Pentaho versions 8.3.0.0 before GA Description: The Dashboard Editor in Hitachi Vantara Pentaho contains an X...
CVE-2020-24670: Improper Neutralization of Input During Web Page Generation
The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter...
PT-2021-11056
Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho versions 7.x through 8.x Description: The dashboard Editor in Hitachi Vantara Pentaho contains a reflected Cross-site scripting issue, allowing authenticated remote users to execute arbitrary JavaScript code. The...
Hitachi Vantara Pentaho 注入漏洞
Pentaho is a Business Intelligence BI software that provides data integration, OLAP services, reporting, information dashboards, data mining, and Extract, Transform, Load ETL capabilities. An XML entity extension injection vulnerability exists in the 'dashboardXml' parameter of the Dashboard Edit...
Protecting multi-cloud environments with Azure Security Center
We’ve heard from many of you that multi-cloud adoption is becoming a standard operating model for your organization and that it’s challenging to have the right security controls and posture across your environment. Historically, security teams have not had effective tools to secure multi-cloud...
Directory Traversal
node-red-dashboard is vulnerable to directory traversal. Lack of validation in the URL allows an attacker to access system files outside of the webroot via a malicious URL such as /uibase/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd...
Openlitespeed Web Server 1.7.8 - Command Injection (Authenticated) (1)
Exploit Title: Openlitespeed WebServer 1.7.8 - Command Injection Authenticated Date: 26/1/2021 Exploit Author: cmOs - SunCSR Vendor Homepage: https://openlitespeed.org/ Software Link: https://openlitespeed.org/kb/install-from-binary/ Version: 1.7.8 Tested on Windows 10 Step 1: Log in to the...
