CVE-2022-4770

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-477007.5COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Acce CVE-2022-477016.1COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS CVE-2022-477037.5TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, an CVE-2022-47716.1Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject con CVE-2022-477149.8Last Yard 22.09.8-1 does not enforce HSTS headers CVE-2022-477155.3In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.CVE-2022-477177.5Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).CVE-2022-47727.8A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/wid CVE-2022-47733.3** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the func CVE-2022-477327.5In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing ad CVE-2022-47749.8The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated CVE-2022-477409.8Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.