alldata 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk sql injection and パス処理の欠陥 などに関し、一部は ファイル上書き を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-29434 | An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file. | [email protected] | 8.3 | 0.67% | 2024-04-02 | 2025-04-30 |
| CVE-2024-29432 | Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas. | [email protected] | 9.8 | 0.16% | 2024-04-02 | 2025-04-30 |
| CVE-2024-27605 | Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system. | [email protected] | 7.5 | 0.15% | 2024-04-02 | 2025-03-28 |
| CVE-2024-27604 | Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized. | [email protected] | 9.8 | 0.25% | 2024-04-02 | 2025-03-27 |
| CVE-2024-27602 | Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module. | [email protected] | 9.1 | 0.19% | 2024-04-02 | 2025-04-30 |
| CVE-2024-29435 | An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter. | [email protected] | 4.1 | 0.14% | 2024-04-01 | 2025-05-07 |
| CVE-2024-29433 | A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data. | [email protected] | 9.8 | 0.13% | 2024-04-01 | 2025-05-07 |