CVE-2023-40183 DataEase has a vulnerability to obtain user cookies

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

CVE-2023-40183

CVE-2023-40183 affects DataEase prior to 1.18.11. The vulnerability arises because the application uses only ImageIO.read() to verify image files without restricting allowed suffixes, enabling an attacker to embed executable/attack code in an image and rename it with an HTML extension to steal us...

CVE-2023-40183 DataEase has a vulnerability to obtain user cookies

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

CVE-2023-40183 DataEase has a vulnerability to obtain user cookies

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

DataEase Code Issues Vulnerabilities

DataEase is an open source data visualization and analysis tool. It is used to help users quickly analyze data and gain insight into business trends to achieve business improvement and optimization. A code issue vulnerability exists in DataEase versions prior to 1.18.11. The vulnerability stems...

PT-2023-27312 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.11 Description: DataEase is an open source data visualization and analysis tool. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

SQL Injection

dataease-plugin-common is vulnerable to SQL Injection. The vulnerability exists through the PluginGridSql.xml due to the lack of query validation, allowing an attacker to gain sensitive information via a maliciously crafted string outside the blacklist function...

DataEase vulnerable to SQL injection

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

GHSA-8RV7-G772-PP3J DataEase vulnerable to SQL injection

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

Sql injection

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

PT-2023-27633 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase version 1.18.9 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function. Recommendations: For DataEase version 1.18.9, at the moment, there is ...

DataEase SQL Injection Vulnerability

DataEase is an open source data visualization and analysis tool. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. A security vulnerability exists in DataEase version v.1.18.9, which stems from the presence of a SQL...

CVE-2023-40771

CVE-2023-40771 : DataEase v1.18.9 suffers a SQL injection due to processing a crafted string that bypasses the blacklist function, enabling a remote attacker to obtain sensitive information. The vulnerability is documented across multiple sources (e.g., Red Hat, NVD, GOV advisories) with an affec...

CVE-2023-40771

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...

CVE-2023-37258

DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. The vulnerability has been fixed in v1.18.9. There are no known workarounds...

CVE-2023-37257

DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds...

Cross site scripting

DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds...