Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
118 results · page 3 of 3
Jul 25, 2023DataEase is an open source data visualization analysis tool.CVE-2023-37258 · Other software · dataease · reported by GitHubHigh 8.8
DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. The vulnerability has been fixed in v1.18.9. There are no known workarounds.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023DataEase is an open source data visualization analysis tool.CVE-2023-37257 · Other software · dataease · reported by GitHubMedium 5.4
DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-35164 · Other software · dataease · reported by GitHubMedium 6.3
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-35168 · Other software · dataease · reported by GitHubMedium 6.5
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends.CVE-2023-34463 · Other software · dataease · reported by GitHubHigh 8.1
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023DataEase is an open source data visualization and analysis tool.CVE-2023-33963 · Other software · dataease · reported by GitHubCritical 9.8
DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023DataEase is an open source data visualization and analysis tool.CVE-2023-32310 · Other software · dataease · reported by GitHubHigh 8.1
DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2023DataEase is an open source data visualization analysis tool.CVE-2023-28637 · Other software · dataease · reported by GitHubHigh 8
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Dataease is an open source data visualization and analysis tool.CVE-2023-28437 · Other software · dataease · reported by GitHubCritical 9.8
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Dataease is an open source data visualization and analysis tool.CVE-2023-28435 · Other software · dataease · reported by GitHubMedium 6.5
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023DataEase is an open source data visualization and analysis tool.CVE-2023-25807 · Other software · dataease · reported by GitHubHigh 7.2
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.CVE-2021-38239 · Other software · Dataease · reported by MITREHigh 7.5
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Dataease is an open source data visualization analysis tool.CVE-2022-39312 · Other software · dataease · reported by GitHubCritical 9.8
Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.CVE-2022-34115 · Other software · Dataease · reported by MITRECritical 9.8
DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.CVE-2022-34114 · Other software · Dataease · reported by MITREHigh 8.8
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.CVE-2022-34113 · Other software · Dataease · reported by MITRECritical 9.8
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved CVE-2022-34112 · Other software · Dataease · reported by MITREMedium 6.5
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.CVE-2022-23331 · Other software · Dataease · reported by MITREHigh 8.8
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.