AJ-Report vulnerabilities
8 known vulnerabilities in AJ-Report from Anji-plus. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
AJ-Report: Use of Hard-coded Cryptographic Key
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoade
- 9.8 Critical severity
AJ-Report: Authentication Bypass Using an Alternate Path or Channel
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was obser
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclo
- 9.8 Critical severity
AJ-Report: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The expl
- 9.8 Critical severity
AJ-Report: Deserialization of Untrusted Data
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the component com.anjiplus.template.gaea.business.modules.datasetparam.controller.DataSetParamController#veri
- 9.8 Critical severity
AJ-Report: Deserialization of Untrusted Data
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be laun
- 9.8 Critical severity
AJ-Report: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The manipulation of the argument p leads to sql injection. It is possible to launch the attack remotely.