CVE-2025-0756

Overview   The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99)   Description   Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creation of platform data sources.   Impact   An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.

• CWE-99

• https://https://support.pentaho.com/hc/en-us/articles/35771876077709--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0756

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0750A vulnerability was found in CRI-O. A path traversal issue i…6.6
• CVE-2025-0751A vulnerability classified as critical has been found in Axi…6.5
• CVE-2025-0752A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. …7.1
• CVE-2025-0753A vulnerability classified as critical was found in Axiomati…6.5
• CVE-2025-0754The vulnerability was found in OpenShift Service Mesh 2.6.3 …4.3
• CVE-2025-0755The various bson_append functions in the MongoDB C driver li…7.5
• CVE-2025-0757Overview   The software does not neutralize or incorre…4.4
• CVE-2025-0758Overview  The product specifies permissions for a securit…6.1
• CVE-2025-0759IBM EntireX 11.1 could allow a local user to unintentionally…3.3
• CVE-2025-0760A Credential Disclosure vulnerability exists where an admini…2.7
• CVE-2025-0762Use after free in DevTools in Google Chrome prior to 132.0.6…8.8
• CVE-2025-0763The Ultimate Classified Listings plugin for WordPress is vul…4.3