J2eefast
J2eefast: vulnerabilidades y CVE
J2eefast tiene 21 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses0
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-45944 | Crítica (9.8) | 0.87% | — | 18 oct 2024 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution. |
| CVE-2024-35091 | Crítica (9.8) | 0.42% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml. |
| CVE-2024-35090 | Alta (8.2) | 0.32% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml. |
| CVE-2024-35086 | Crítica (9.8) | 0.53% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml . |
| CVE-2024-35085 | Media (5.4) | 0.24% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml. |
| CVE-2024-35084 | Crítica (9.8) | 0.42% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml. |
| CVE-2024-35083 | Alta (8.8) | 0.40% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml. |
| CVE-2024-35082 | Media (6.3) | 0.25% | — | 23 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml. |
| CVE-2024-33164 | Crítica (9.8) | 0.57% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function. |
| CVE-2024-33161 | Media (5.3) | 0.24% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function. |
| CVE-2024-33155 | Crítica (9.8) | 0.56% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function. |
| CVE-2024-33153 | Crítica (9.8) | 0.56% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function. |
| CVE-2024-33149 | Alta (8.1) | 0.48% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function. |
| CVE-2024-33148 | Alta (7.3) | 0.37% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function. |
| CVE-2024-33147 | Alta (8.8) | 0.55% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function. |
| CVE-2024-33146 | Crítica (9.1) | 0.52% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function. |
| CVE-2024-33144 | Alta (8.8) | 0.54% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml. |
| CVE-2024-33139 | Alta (7.5) | 0.51% | — | 7 may 2024 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function. |
| CVE-2023-2476 | Media (5.4) | 0.52% | — | 2 may 2023 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0. It has been classified as problematic. Affected is an unknown function of the component Announcement Handler. The manipulation of the argument 系统工具/公告管理 leads… |
| CVE-2023-2475 | Media (5.4) | 0.52% | — | 2 may 2023 | A vulnerability was found in Dromara J2eeFAST up to 2.6.0 and classified as problematic. This issue affects some unknown processing of the component System Message Handler. The manipulation of the argument 主题 leads to… |
| CVE-2021-28890 | Crítica (9.8) | 1.3% | — | 12 ago 2021 | J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list,… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.