Filtered by vendor Dataease
Subscriptions
Filtered by product Dataease
Subscriptions
Total
28 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-34463 | 1 Dataease | 1 Dataease | 2024-11-21 | 8.1 High |
| DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2022-39312 | 1 Dataease | 1 Dataease | 2024-11-21 | 9.8 Critical |
| Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue. | ||||
| CVE-2022-34113 | 1 Dataease | 1 Dataease | 2024-11-21 | 9.8 Critical |
| An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. | ||||
| CVE-2022-23331 | 1 Dataease | 1 Dataease | 2024-11-21 | 8.8 High |
| In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. | ||||
| CVE-2021-38239 | 1 Dataease | 1 Dataease | 2024-11-21 | 7.5 High |
| SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. | ||||
| CVE-2024-47074 | 1 Dataease | 1 Dataease | 2024-11-12 | 9.8 Critical |
| DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java, PgConfiguration class don't filter any parameters, directly concat user input. So, if the attacker adds some parameters in JDBC url, and connect to evil PG server, the attacker can trigger the PG jdbc deserialization vulnerability, and eventually the attacker can execute through the deserialization vulnerability system commands and obtain server privileges. The vulnerability has been fixed in v1.18.25. | ||||
| CVE-2024-46997 | 1 Dataease | 1 Dataease | 2024-10-07 | 9.8 Critical |
| DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1. | ||||
| CVE-2024-46985 | 1 Dataease | 1 Dataease | 2024-09-27 | 7.5 High |
| DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1. | ||||