Filtered by vendor Dataease
Subscribe
Total
13 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-37258 | 1 Dataease | 1 Dataease | 2024-02-05 | N/A | 9.8 CRITICAL |
| DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. The vulnerability has been fixed in v1.18.9. There are no known workarounds. | |||||
| CVE-2023-37257 | 1 Dataease | 1 Dataease | 2024-02-05 | N/A | 5.4 MEDIUM |
| DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds. | |||||
| CVE-2023-28437 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 9.8 CRITICAL |
| Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds. | |||||
| CVE-2023-35168 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 6.5 MEDIUM |
| DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability. | |||||
| CVE-2023-32310 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 8.1 HIGH |
| DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading. | |||||
| CVE-2023-28435 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 6.1 MEDIUM |
| Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5. | |||||
| CVE-2023-35164 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 6.5 MEDIUM |
| DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-33963 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 9.8 CRITICAL |
| DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading. | |||||
| CVE-2023-34463 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 8.1 HIGH |
| DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-25807 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 5.4 MEDIUM |
| DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3. | |||||
| CVE-2021-38239 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 7.5 HIGH |
| SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. | |||||
| CVE-2022-34113 | 1 Dataease | 1 Dataease | 2024-02-04 | N/A | 9.8 CRITICAL |
| An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. | |||||
| CVE-2022-23331 | 1 Dataease | 1 Dataease | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. | |||||