Lucene search
K

6 matches found

RedhatCVE
RedhatCVE
added 2025/08/30 6:17 p.m.2 views

CVE-2025-57773

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...

9.8CVSS7.2AI score0.00545EPSS
Exploits1References1
NVD
NVD
added 2025/08/25 5:15 p.m.1 views

CVE-2025-57773

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...

9.8CVSS0.00545EPSS
Exploits1References2
CVE
CVE
added 2025/08/25 4:42 p.m.19 views

CVE-2025-57773

CVE-2025-57773 affects DataEase prior to version 2.10.12, where unfiltered DB2 parameters enable a JNDI injection that triggers an AspectJWeaver deserialization attack, writing to files. The exploitation requires the presence of commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerabil...

9.8CVSS6.7AI score0.00545EPSS
Exploits1References2Affected Software1
OSV
OSV
added 2025/08/25 4:42 p.m.3 views

CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...

8.2CVSS7.2AI score0.00545EPSS
Exploits1References4
Positive Technologies
Positive Technologies
added 2025/08/25 12:0 a.m.3 views

PT-2025-34683

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.12 Description: DataEase is an open source business intelligence and data visualization tool. Due to insufficient filtering of DB2 parameters, a JNDI injection attack can be launched, triggering an AspectJWeave...

9.8CVSS6.7AI score0.00545EPSS
Exploits1References12
Zero Day Initiative
Zero Day Initiative
added 2020/07/20 12:0 a.m.45 views

Oracle WebLogic Server T3 Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle WebLogic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the aspectjweaver library. The issue results from the lack of proper validation of...

9.8CVSS4.3AI score0.07093EPSS
Exploits0References1
Rows per page
Query Builder