Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| alldata | alldata | 0.4.6 |