Overview 6 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
6
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
6
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
33.3%
Working exploit published
4
66.7%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2 / month
Apr 241
Not applicable1
Medium1
not blocked1
Exploited1
May 240
Jun 240
Jul 240
Aug 240
Sep 240
Oct 240
Nov 241
Not applicable1
Critical1
not blocked1
Working exploit published1
Dec 240
Jan 251
Not applicable1
Critical1
not blocked1
Working exploit published1
Feb 250
Mar 250
Apr 251
Not applicable1
High1
not blocked1
Working exploit published1
May 250
Jun 252
Not applicable2
High2
not blocked2
Exploited1
Working exploit published1
Apr 24Jun 24Aug 24Oct 24Dec 24Feb 25Apr 25Jun 25
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-49002 | High | 2025-06-03 | Not applicable | Exploited | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available. |
| CVE-2025-49001 | High | 2025-06-03 | Not applicable | Working exploit published | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available. |
| CVE-2025-32966 | High | 2025-04-23 | Not applicable | Working exploit published | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8. |
| CVE-2024-56511 | Critical | 2025-01-10 | Not applicable | Working exploit published | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the "WhitelistUtils.match" method to determine whether the URL request is an interface that does not require authentication. The "match" method filters semicolons, but this is not enough. When users set "server.servlet.context-path" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4. |
| CVE-2024-47073 | Critical | 2024-11-07 | Not applicable | Working exploit published | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2024-30269 | Medium | 2024-04-08 | Not applicable | Exploited | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading. |