Skip to content

Vendor

anji-plus vulnerabilities

11 published CVES affecting anji-plus, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
11
Critical
3
High
1
Medium
7
Low
0
Unscored
0
CISA KEV
0
Atom feed of anji-plus alerts

Products

Latest anji-plus CVEs

Newest publication first

  2. CVE-2024-7314 anji-plus AJ-Report Authentication Bypass

    Published
    CriticalCVSS 9.8 EPSS 51.7%

    anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowser...

  3. CVE-2024-5356 anji-plus AJ-Report testTransform;swagger-ui sql injection

    Published
    MediumCVSS 5.3 EPSS 1.0%

    A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack...

  4. CVE-2024-5355 anji-plus AJ-Report IGroovyHandler command injection

    Published
    MediumCVSS 5.3 EPSS 3.2%

    A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public an...

  5. CVE-2024-5354 anji-plus AJ-Report detailByCode information disclosure

    Published
    MediumCVSS 5.3 EPSS 0.63%

    A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1. This vulnerability affects unknown code of the file /reportShare/detailByCode. The manipulation of the argument shareToken leads to information disclosure. The attack can be initiated remotely...

  6. CVE-2024-5353 anji-plus AJ-Report ZIP File decompress path traversal

    Published
    MediumCVSS 5.3 EPSS 0.80%

    A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclos...

  7. CVE-2024-5352 anji-plus AJ-Report validationRules deserialization

    Published
    MediumCVSS 5.3 EPSS 0.77%

    A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the component com.anjiplus.template.gaea.business.modules.datasetparam.controller.DataSetParamController#verification. The manipu...

  8. CVE-2024-5351 anji-plus AJ-Report Javascript getValueFromJs deserialization

    Published
    MediumCVSS 5.3 EPSS 0.77%

    A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The e...

  9. CVE-2024-5350 anji-plus AJ-Report pageList sql injection

    Published
    MediumCVSS 5.3 EPSS 0.60%

    A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The manipulation of the argument p leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.