81
CVEs
13
Critical
31
High
0
KEV
8
PoC
39
Unpatched C/H
11.1%
Patch Rate
1.4%
Avg EPSS
Severity Breakdown
CRITICAL
13
HIGH
31
MEDIUM
35
LOW
2
Monthly CVE Trend
Affected Products (30)
Device Manager
11
Vantara Pentaho
7
It Operations Director
6
Jp1 It Desktop Management Manager
5
Tuning Manager
5
Job Management Partner 1 It Desktop Management Manager
5
Ops Center Analyzer
4
Jp1 It Desktop Management 2 Operations Director
4
Eh View
4
Vantara Pentaho Business Intelligence Server
4
Job Management Partner 1 Software Distribution Client
4
Job Management Partner 1 It Desktop Management 2 Manager
4
Cosminexus Component Container
4
Job Management Partner 1 Software Distribution Manager
4
Jp1 It Desktop Management 2 Manager
4
Hitachi Virtual Storage Platform G130 G150 G350 G370 G700 G900 F350 F370 F700 F900
4
Ops Center Common Services
3
Hitachi Virtual Storage Platform E390 E590 E790 E990 E1090 E390H E590H E790H E1090H
3
Pentaho Business Analytics Server
3
Infrastructure Analytics Advisor
3
Jp1 Netm Dm Client
3
Tiered Storage Manager
3
Open Redirect
3
Jp1 Netm Dm Manager
3
Replication Manager
3
Ops Center Api Configuration Manager
2
Hitachi Infrastructure Analytics Advisor
2
Jwt Attack
2
Global Link Manager
2
Hitachi Ops Center Analyzer
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2021-34684 | Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data source and thus retrieve data from the related databases, as. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 5.8% | 69 |
PoC
No patch
|
| CVE-2021-3196 | An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.0% | 64 |
PoC
No patch
|
| CVE-2021-31599 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.3% | 64 |
PoC
No patch
|
| CVE-2021-31602 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 51.7% | 58 |
PoC
No patch
|
| CVE-2021-34685 | UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 2.2% | 56 |
PoC
No patch
|
| CVE-2012-4274 | Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B and Cobol GUI Option Server 07-00, 07-01 before 07-01-/B,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 5.9% | 56 |
No patch
|
| CVE-2012-0918 | Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 4.3% | 54 |
No patch
|
| CVE-2017-9294 | RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 4.4% | 53 |
No patch
|
| CVE-2021-31601 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 1.3% | 52 |
PoC
No patch
|
| CVE-2021-29644 | Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.5% | 49 |
No patch
|
| CVE-2022-41552 | Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2024-0715 | Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.8.7-03. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2024-5828 | Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.8.7-00. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-71374 | Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-71376 | OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 1.0% | 49 |
|