Dataease

Dataease

62 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2023-32310

Exploit
  • EPSS 0.18%
  • Veröffentlicht 01.06.2023 16:15:09
  • Zuletzt bearbeitet 21.11.2024 08:03:05

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's...

8.8

CVE-2023-28637

Exploit
  • EPSS 3.02%
  • Veröffentlicht 28.03.2023 21:15:11
  • Zuletzt bearbeitet 21.11.2024 07:55:42

DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may ...

9.8

CVE-2023-28437

Exploit
  • EPSS 0.3%
  • Veröffentlicht 25.03.2023 00:15:08
  • Zuletzt bearbeitet 21.11.2024 07:55:03

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.

6.1

CVE-2023-28435

Exploit
  • EPSS 0.33%
  • Veröffentlicht 24.03.2023 21:15:06
  • Zuletzt bearbeitet 21.11.2024 07:55:03

Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload ...

5.4

CVE-2023-25807

Exploit
  • EPSS 0.87%
  • Veröffentlicht 28.02.2023 16:15:09
  • Zuletzt bearbeitet 21.11.2024 07:50:14

DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attack...

7.5

CVE-2021-38239

Exploit
  • EPSS 0.54%
  • Veröffentlicht 15.02.2023 22:15:11
  • Zuletzt bearbeitet 20.03.2025 14:15:14

SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.

9.8

CVE-2022-39312

Exploit
  • EPSS 0.89%
  • Veröffentlicht 25.10.2022 17:15:55
  • Zuletzt bearbeitet 21.11.2024 07:18:00

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql serve...

6.5

CVE-2022-34112

Exploit
  • EPSS 0.15%
  • Veröffentlicht 22.07.2022 23:15:08
  • Zuletzt bearbeitet 24.09.2025 19:42:14

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.

9.8

CVE-2022-34113

Exploit
  • EPSS 0.31%
  • Veröffentlicht 22.07.2022 23:15:08
  • Zuletzt bearbeitet 21.11.2024 07:08:53

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.

8.8

CVE-2022-34114

Exploit
  • EPSS 0.24%
  • Veröffentlicht 22.07.2022 23:15:08
  • Zuletzt bearbeitet 24.09.2025 19:42:06

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.