805 matches found
CVE-2023-28437
Dataease SQL injection vulnerability (CVE-2023-28437) is caused by a missing entries in the keyword blacklist protecting against SQLi. Affects Dataease prior to version 1.18.5; fix released in 1.18.5. CVSS v3.1 base score 9.8 (CRITICAL) with NETWORK attack, LOW complexity, no privileges, no user ...
CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds...
CVE-2023-28435
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has bee...
CVE-2023-28435 Dataease file upload interface does not verify permission or file type
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has bee...
CVE-2023-28435 Dataease file upload interface does not verify permission or file type
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has bee...
CVE-2023-28435 Dataease file upload interface does not verify permission or file type
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has bee...
CVE-2023-28435
Dataease file-upload vulnerability: permissions are not checked and file types are unchecked, enabling non-logged-in users to upload arbitrary files. Affected versions prior to 1.18.5. Remediation: upgrade to 1.18.5 (or apply provided fix).
PT-2023-21718 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: The issue concerns the file upload interface in Dataease, where permissions are not properly checked, allowing users who are not logged in to upload files directly to the background. Additionally...
DataEase 跨站脚本漏洞
DataEase is an open source data visualization and analysis tool. It is used to help users quickly analyze data and gain insights into business trends for business improvement and optimization. A cross-site scripting vulnerability exists in DataEase 1.18.4 and earlier versions that stems from not...
PT-2023-21720 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.5 Description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. Recommendations: For versions prior to 1.18.5, update to version...
CVE-2023-25807
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses th...
CVE-2023-25807 DataEase dashboard has a stored XSS vulnerability
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses th...
CVE-2023-25807
DataEase dashboard storage vulnerability (CVE-2023-25807) allows stored XSS via manipulated saved data. Affected software: DataEase open-source data visualization/analysis tool. Root cause: saving a dashboard can store malicious code which is executed server-side when the dashboard is viewed. Imp...
CVE-2023-25807 DataEase dashboard has a stored XSS vulnerability
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses th...
CVE-2023-25807 DataEase dashboard has a stored XSS vulnerability
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses th...
PT-2023-20319 · Dataease · Dataease
Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.3 Description: The issue concerns the DataEase platform, an open source data visualization and analysis tool. When saving a dashboard, an attacker can modify the saved data to store malicious code. This can lea...
DataEase 跨站脚本漏洞
DataEase is an open source data visualization and analysis tool. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase version before 1.18.3 has a security vulnerability , the vulnerability stems from the saved...
CVE-2021-38239
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sysmsg/list/1/10...
