7 results · Feed
-
High 7.5
DataEase vulnerable to SQL injection
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.
-
High 8.1
DataEase API interface has IDOR vulnerability
DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboar…
-
Critical 9.8
Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target …
-
Medium 6.5
Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.
-
High 8.8
SQL Injection found in Dataease
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
-
Critical 9.8
Dataease before 1.11.2 allows arbitrary code execution via crafter plugin
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
-
Critical 9.8
Dataease v1.11.1 SQL Injection via parameter dataSourceId
DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.