Dataease · product
dataease
104 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 6
- likely to be exploited
- 2
Every one of the 104 is a mark on the map. Named now: 1 to 26, most at risk first.
- DataEase - Remote Code Execution
- DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal
- DataEase < 2.10.10 - JWT Authentication Bypass
- DataEase <= 2.4.1 - Sensitive Information Exposure
- DataEase 2.10.4-2.10.7 - Remote Code Execution
- DataEase v2.10.2 - JWT Signature Verification Bypass
- Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
- Dataease H2 JDBC RCE Bypass
- Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
- Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
- DataEase's H2 datasource has a remote command execution risk
- Dataease has a JDBC attack vulnerability in the Impala datasource
- An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
- DataEase data source has deserialization vulnerability
- DataEase AWS redshift data source exists for remote code execution vulnerability
- DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
- The Dataease datasource exists deserialization and arbitrary file read vulnerability
- In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
- DataEase's DB2 is vulnerable to SSRF
- DataEase has a SQL injection vulnerability that can bypass blacklists
- Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
- DataEase vulnerable to remote code execution via H2 JDBC driver bypass
- DataEase API interface has IDOR vulnerability
- SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.
- A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.jav…
- Dataease H2 JDBC Connection Remote Code Execution
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.