CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 25/03/2023 |
| CVE-2023-28435 | 中6.1 | Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18 | 24/03/2023 |
| CVE-2023-25807 | 中5.4 | DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulner | 28/02/2023 |
| CVE-2021-38239 | 高7.5 | SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. | 15/02/2023 |
| CVE-2022-39312 | 緊急9.8 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provid | 25/10/2022 |
| CVE-2022-34115 | 緊急9.8 | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. | 22/07/2022 |
| CVE-2022-34114 | 高8.8 | Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. | 22/07/2022 |
| CVE-2022-34113 | 緊急9.8 | An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. | 22/07/2022 |
| CVE-2022-34112 | 中6.5 | An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. | 22/07/2022 |
| CVE-2022-23331 | 高8.8 | In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. | 08/02/2022 |