Alldata
by Alldata
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-29432 | Cri | 0.64 | 9.8 | 0.01 | Apr 2, 2024 | Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas. | ||
| CVE-2024-27604 | Cri | 0.64 | 9.8 | 0.01 | Apr 2, 2024 | Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized. | ||
| CVE-2024-27602 | Cri | 0.59 | 9.1 | 0.00 | Apr 2, 2024 | Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module. | ||
| CVE-2024-29434 | Hig | 0.54 | 8.3 | 0.01 | Apr 2, 2024 | An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file. | ||
| CVE-2024-27605 | Hig | 0.49 | 7.5 | 0.00 | Apr 2, 2024 | Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system. | ||
| CVE-2024-29435 | Med | 0.27 | 4.1 | 0.00 | Apr 1, 2024 | An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter. |
- risk 0.64cvss 9.8epss 0.01
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
- risk 0.64cvss 9.8epss 0.01
Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.
- risk 0.59cvss 9.1epss 0.00
Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.
- risk 0.54cvss 8.3epss 0.01
An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.
- risk 0.49cvss 7.5epss 0.00
Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.
- risk 0.27cvss 4.1epss 0.00
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.