Skip to content
OpenAdvisories
High ICSA-25-261-04 6 CVEs

Multiple Open-Source Software Vulnerabilities in Hitachi Energy Asset Suite Product

Published Aug 26, 2025 · Updated Aug 26, 2025

Vendor: Hitachi Energy Product: Asset Suite

Summary

Hitachi Energy is aware of multiple reported vulnerabilities that affect the Asset Suite product versions mentioned in this document below. If exploited these vulnerabilities can potentially impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

Vulnerabilities 6

  • High 8.8
    CVE-2022-41678 Public exploit Scanner template EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 8.4
    CVE-2022-45868

    Password exposure in H2 Database

    The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker t…

    com.h2database:h2 h2database Debian Maven
  • High 8.1
    CVE-2024-22262 Public exploit

    CVE-2024-22262: Spring Framework URL Parsing with Host Validation

    Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • High 7.1
    CVE-2022-44729

    Apache XML Graphics Batik: Information disclosure vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource…

    Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven
  • High 7.1
    CVE-2023-6378

    Logback "receiver" DOS vulnerability

    A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

    QOS.CH Sarl logback trino tez Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2025-23184

    Apache CXF: Denial of Service vulnerability with temporary files

    A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies …

    Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven

Revision history

  1. #1

    Initial version.

References