PatchTheCVE: bi serverhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2009-5101: Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackehttps://patchthecve.com/cve/CVE-2009-5101.htmlhttps://patchthecve.com/cve/CVE-2009-5101.htmlTue, 16 Jun 2026 23:15:01 +0000MEDIUM 5.0: Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.CVE-2009-5100: Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a passworhttps://patchthecve.com/cve/CVE-2009-5100.htmlhttps://patchthecve.com/cve/CVE-2009-5100.htmlTue, 16 Jun 2026 23:15:01 +0000LOW 2.1: Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.CVE-2009-5099: Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remohttps://patchthecve.com/cve/CVE-2009-5099.htmlhttps://patchthecve.com/cve/CVE-2009-5099.htmlTue, 16 Jun 2026 23:15:00 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.