Dataease
Page 2 of 2 — Dataease CVEs from a corpus of 111, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28637 | High | 8.0 | 2023-03-28 | DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properl… |
CVE-2023-28437 | Critical | 9.8 | 2023-03-25 | Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fix… |
CVE-2023-28435 | Medium | 6.5 | 2023-03-24 | Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in ca… |
CVE-2023-25807 | High | 7.2 | 2023-02-28 | DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store maliciou… |
CVE-2021-38239 | High | 7.5 | 2023-02-15 | SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-34115 | Critical | 9.8 | 2022-07-22 | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. |
CVE-2022-34114 | High | 8.8 | 2022-07-22 | Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. |
CVE-2022-34113 | Critical | 9.8 | 2022-07-22 | An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. |
CVE-2022-34112 | Medium | 6.5 | 2022-07-22 | An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved… |
CVE-2022-23331 | High | 8.8 | 2022-02-08 | In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. |