CVE-2024-29432

Alldata v0.4.6 is vulnerable to a SQL injection vulnerability caused by improper neutralization of special elements in the tablename parameter at the /data/masterdata/datas API endpoint. This flaw allows for potential exploitation of the underlying database. As a temporary workaround, it is recom...

PT-2024-21963

Name of the Vulnerable Software and Affected Versions Alldata version 0.4.6 Description The issue allows for command execution, where system commands can be deserialized. Recommendations For Alldata version 0.4.6, as a temporary workaround, consider restricting the deserialization of system...

CVE-2024-29434: Improper Limitation of a Pathname to a Restricted Directory

An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file...

ALLDATA SQL注入漏洞

ALLDATA is an online resource for automotive original equipment manufacturer information from ALLDATA, Inc. It provides diagnostic and repair information for vehicle manufacturers. A SQL injection vulnerability exists in ALLDATA version V0.4.6, which stems from the tablename parameter in...

CVE-2024-29432

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas...

CVE-2024-29432: Improper Neutralization of Special Elements used in an SQL Command

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas...

CVE-2024-29432

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas...

PT-2024-21962 · Alldata · Alldata

Name of the Vulnerable Software and Affected Versions: Alldata version 0.4.6 Description: The issue is related to Incorrect Access Control, resulting in the leakage of many modules' interface documents. For example, the "/api/system/v2/api-docs" module is affected. Recommendations: For Alldata...

CVE-2024-27605

Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users test can query information about the users in the system...

CVE-2024-27602

Alldata version V0.4.6 is affected by an Incorrect Access Control vulnerability that leads to the leakage of interface documents for multiple modules. Specifically, the /api/system/v2/api-docs module is exposed, potentially revealing sensitive internal technical details. To minimize risk, it is r...

CVE-2024-27602: Improper Access Control

Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

ALLDATA 安全漏洞

ALLDATA is an online resource for automotive OEM information from ALLDATA, Inc. It provides diagnostic and repair information for vehicle manufacturers. A security vulnerability exists in ALLDATA version v0.4.6, which stems from a deserialization vulnerability in the FASTJSON component that allow...

ALLDATA 安全漏洞

ALLDATA is an online resource for automotive OEM information from ALLDATA, Inc. It provides diagnostic and repair information for vehicle manufacturers. A security vulnerability exists in ALLDATA version v0.4.6 that originated from allowing an attacker to run arbitrary commands via the processId...

CVE-2024-29433: Deserialization of Untrusted Data

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

PT-2024-22893 · Fastjson +1 · Fastjson +1

Name of the Vulnerable Software and Affected Versions: Alldata version 0.4.6 Description: A deserialization vulnerability in the FASTJSON component allows attackers to execute arbitrary commands via supplying crafted data. Recommendations: For Alldata version 0.4.6, at the moment, there is no...