Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.dataease:dataease-plugin-common

7 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical, 1 high
Registry
Maven Central

Advisories 7

  • SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of…

    Affected: through 1.18.9.

  • DataEase API interface has IDOR vulnerability

    Affected: fixed in 1.18.7.

  • CVE-2022-39312Critical 9.8

    Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

    Affected: fixed in 1.15.2.

  • Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.

    Affected: fixed in 1.11.2.

  • An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a…

    Affected: fixed in 1.11.2.

  • An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.

    Affected: fixed in 1.11.2.

  • DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.

    Affected: fixed in 1.11.2.