Search
Find a vulnerability
Search criteria
6 vulnerabilities found for bi_server by pentaho
CVE-2009-5101 (GCVE-0-2009-5101)
Vulnerability from nvd – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
| http://jira.pentaho.com/browse/BISERVER-3245 | x_refsource_CONFIRM |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5101",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "http://jira.pentaho.com/browse/BISERVER-3245",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5101",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5100 (GCVE-0-2009-5100)
Vulnerability from nvd – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://jira.pentaho.com/browse/BISERVER-2698?page… | x_refsource_CONFIRM |
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5100",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5100",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5099 (GCVE-0-2009-5099)
Vulnerability from nvd – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/37024 | third-party-advisoryx_refsource_SECUNIA |
| http://jira.pentaho.com/browse/BISERVER-2698?page… | x_refsource_CONFIRM |
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.vupen.com/english/advisories/2009/2972 | vdb-entryx_refsource_VUPEN |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37024",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37024"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37024",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37024"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5099",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37024",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37024"
},
{
"name": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5099",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5101 (GCVE-0-2009-5101)
Vulnerability from cvelistv5 – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
| http://jira.pentaho.com/browse/BISERVER-3245 | x_refsource_CONFIRM |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5101",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "http://jira.pentaho.com/browse/BISERVER-3245",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-3245"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5101",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5099 (GCVE-0-2009-5099)
Vulnerability from cvelistv5 – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/37024 | third-party-advisoryx_refsource_SECUNIA |
| http://jira.pentaho.com/browse/BISERVER-2698?page… | x_refsource_CONFIRM |
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.vupen.com/english/advisories/2009/2972 | vdb-entryx_refsource_VUPEN |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37024",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37024"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "37024",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37024"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5099",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37024",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37024"
},
{
"name": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
},
{
"name": "ADV-2009-2972",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/2972"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5099",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5100 (GCVE-0-2009-5100)
Vulnerability from cvelistv5 – Published: 2011-09-13 19:00 – Updated: 2024-08-07 07:24
VLAI
EPSS
VEX
Summary
Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://jira.pentaho.com/browse/BISERVER-2698?page… | x_refsource_CONFIRM |
| http://antisnatchor.com/2009/06/20/pentaho-170106… | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/507168/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2009-06-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:24:54.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5100",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel",
"refsource": "CONFIRM",
"url": "http://jira.pentaho.com/browse/BISERVER-2698?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel"
},
{
"name": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "http://antisnatchor.com/2009/06/20/pentaho-1701062-multiple-vulnerabilities/"
},
{
"name": "20091013 [AntiSnatchOr] Pentaho Bi-server multiple vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/507168/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5100",
"datePublished": "2011-09-13T19:00:00.000Z",
"dateReserved": "2011-09-13T00:00:00.000Z",
"dateUpdated": "2024-08-07T07:24:54.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}