Vulnerabilities

TI-2024-19457 CVE-2024-29434 · GHSA-fh3p-6j2p-f5qv

An issue in the system image upload interface of Alldata v0.4.6 allows attackers to…

LOW 37

An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00737 Published 2024-04-02 No fix listed CWE-22

TI-2024-19455 CVE-2024-29432 · GHSA-6pg9-cqrm-937h

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename…

MEDIUM 49

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00518 Published 2024-04-02 No fix listed CWE-89

TI-2024-18319 CVE-2024-27605 · GHSA-m9px-xr79-8fvc

Alldata V0.4.6 is vulnerable to Insecure Permissions.

LOW 33

Alldata V0.4.6 is vulnerable to Insecure Permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00443 Published 2024-04-02 No fix listed CWE-284

TI-2024-18318 CVE-2024-27604 · GHSA-48jr-p93f-pwq8

Alldata V0.4.6 is vulnerable to Command execution vulnerability.

MEDIUM 44

Alldata V0.4.6 is vulnerable to Command execution vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01038 Published 2024-04-02 No fix listed CWE-502

TI-2024-18317 CVE-2024-27602 · GHSA-888h-wmgg-wjc5

Alldata V0.4.6 is vulnerable to Incorrect Access Control.

HIGH 74

Alldata V0.4.6 is vulnerable to Incorrect Access Control.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00443 Published 2024-04-02 No fix listed CWE-284

TI-2024-19458 CVE-2024-29435 · GHSA-89vc-qmfw-48wj

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.

LOW 21

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.

CVSS 3.1MEDIUM 4.1 Physical No auth User interaction EPSS 0.00288 Published 2024-04-01 No fix listed CWE-77

TI-2024-19456 CVE-2024-29433 · GHSA-mxqc-99q2-7w6p

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows…

MEDIUM 50

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00833 Published 2024-04-01 No fix listed CWE-502

Vulnerabilities

Filters

An issue in the system image upload interface of Alldata v0.4.6 allows attackers to…

Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename…

Alldata V0.4.6 is vulnerable to Insecure Permissions.

Alldata V0.4.6 is vulnerable to Command execution vulnerability.

Alldata V0.4.6 is vulnerable to Incorrect Access Control.

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows…