Vulnerabilidades em dataease
92 resultadosAnálise Vexday
O DataEase acumula 69 CVEs catalogadas, das quais 12 são de severidade crítica e 11 surgiram nos últimos 90 dias, indicando um ritmo relevante de descoberta recente. O tipo de falha mais comum é CWE-89 (injeção de SQL), o que aponta para fragilidades estruturais na camada de acesso a dados que tendem a ter alto impacto quando exploradas. A CVE mais perigosa ativa no momento é CVE-2025-49002, com EPSS de 0,4184, sugerindo probabilidade não trivial de exploração em curto prazo, apesar de nenhuma CVE constar no catálogo KEV da CISA — taxa abaixo da média geral do catálogo. A existência de PoC pública para ao menos uma vulnerabilidade reforça a necessidade de atenção contínua ao ciclo de atualização deste produto.
CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 45.0%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 44.5%CVE-2025-49001HIGHDataease Authentication Bypass VulnerabilityEPSS 21.7%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 16.0%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 8.8%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 7.8%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 7.8%CVE-2025-32966HIGHDataease H2 JDBC Connection Remote Code ExecutionEPSS 4.4%CVE-2022-39312CRITICALDataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityEPSS 1.5%CVE-2024-46997CRITICALDataEase's H2 datasource has a remote command execution riskEPSS 1.4%CVE-2023-33963CRITICALDataEase data source has deserialization vulnerabilityEPSS 1.3%CVE-2023-28637HIGHDataEase AWS redshift data source exists for remote code execution vulnerabilityEPSS 1.3%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.3%CVE-2024-47073CRITICALDataease arbitrary interface access vulnerabilityEPSS 1.2%CVE-2024-23328CRITICALThe Dataease datasource exists deserialization and arbitrary file read vulnerabilityEPSS 1.2%CVE-2025-64163HIGHDataEase's DB2 is vulnerable to SSRFEPSS 1.1%CVE-2023-37258HIGHDataEase has a SQL injection vulnerability that can bypass blacklistsEPSS 1.1%CVE-2024-55953HIGHDataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read VulnerabilityEPSS 1.1%CVE-2023-32310HIGHDataEase API interface has IDOR vulnerabilityEPSS 1.0%CVE-2025-62420HIGHDataEase vulnerable to remote code execution via H2 JDBC driver bypassEPSS 0.9%