DataEase 安全漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. DataEase version 2.10.6 prior to the existence of a security vulnerability , th...

CVE-2025-27138: Improper Authentication

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known...

CVE-2025-24974: Missing Authorization

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available...

CVE-2025-27103: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. ...

CVE-2024-57707

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

CVE-2024-57707

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

CVE-2024-57707

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

CVE-2024-57707

An issue in DataEase v1 , an open-source data visualization and analysis tool, allows an attacker to execute arbitrary code via the user account and password components . The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code). This flaw enables an attacker to perfo...

CVE-2024-57707

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

PT-2025-5992

Name of the Vulnerable Software and Affected Versions DataEase version 1 Description An issue in DataEase allows an attacker to execute arbitrary code via the user account and password components, specifically through the username and password variables. This issue does not specify the estimated...

CVE-2024-57707: Improper Control of Generation of Code

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

DataEase 安全漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. DataEase has a security vulnerability that stems from allowing an attacker to...

CVE-2024-57707

An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components...

CVE-2022-39312

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In...

CVE-2024-23328

Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. The...

CVE-2024-46997

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1...

CVE-2024-46985

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-31441

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19...

Dataease Auth Bypass

The vulnerability of the io.dataease.auth.filter.TokenFilter class in the Dataease database management system involves bypassing authentication using an alternative username. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information...

CVE-2024-56511

DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class,...