VRT Sign in

Io.dataease Dataease-plugin-common CVEs with no public exploit

4 CVEs, 2 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 4 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

4matches 2protected50.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 2 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 50.0%

Critical 2 50.0% High 1 25.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 50.0% partly blocked 0 0.0% not blocked 2 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 4 100.0%

split by StatusSeverityProtectionExploit maturity peak 4 / month

Jul 224 Protected by Waratek2 No exploit published2 Critical2 High1 Medium1 blocked by ARMR today2 not blocked2 No public exploit4

Jul 22

4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-34115	Critical	2022-07-22	Protected by Waratek	No public exploit	DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CVE-2022-34114	High	2022-07-22	Protected by Waratek	No public exploit	Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
CVE-2022-34113	Critical	2022-07-22	No exploit published	No public exploit	An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
CVE-2022-34112	Medium	2022-07-22	No exploit published	No public exploit	An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-34115

Critical

2022-07-22

Protected by Waratek

No public exploit

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.

CVE-2022-34114

High

2022-07-22

Protected by Waratek

No public exploit

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.

CVE-2022-34113

Critical

2022-07-22

No exploit published

No public exploit

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.

CVE-2022-34112

Medium

2022-07-22

No exploit published

No public exploit

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.