4 results · Clear filters · Feed
-
High 8.9
eKuiper API endpoints handling SQL queries with user-controlled table names.
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. Th…
-
High —
eKuiper /config/uploads API arbitrary file writing may lead to RCE
### Summary eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieve…
-
High 8.5
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement
### Summary Path traversal is also known as directory traversal. These vulnerabilities enable an attacker to read arbitrary files on the server that is running an application. In this case, an attacker might be able to write to arbitrary files on the server, …
-
High 8.8
LF Edge eKuiper has a SQL Injection in sqlKvStore
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulne…