J2
Product
J2eefast
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 7Medium 5Low 0
Watch
Add J2eefast to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45944 | 9.8 | Oct 18 | In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution Affected: before 2.6.0 |
| CVE-2024-35091 | 9.8 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml Affected: 2.7.0 |
| CVE-2024-35086 | 9.8 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml Affected: 2.7.0 |
| CVE-2024-35084 | 9.8 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml Affected: 2.7.0 |
| CVE-2024-33155 | 9.8 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function Affected: 2.7.0 |
| CVE-2024-33153 | 9.8 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function Affected: 2.7.0 |
| CVE-2024-33164 | 9.8 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function Affected: 2.7.0 |
| CVE-2021-28890 | 9.8 | Aug 12 | J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId… Affected: 2.2.1 |
| CVE-2024-33146 | 9.1 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function Affected: 2.7.0 |
| CVE-2024-35083 | 8.8 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml Affected: 2.7.0 |
| CVE-2024-33147 | 8.8 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authRoleList function Affected: 2.7.0 |
| CVE-2024-33144 | 8.8 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findApplyedTasksPage function in BpmTaskMapper.xml Affected: 2.7.0 |
| CVE-2024-35090 | 8.2 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml Affected: 2.7.0 |
| CVE-2024-33149 | 8.1 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the myProcessList function Affected: 2.7.0 |
| CVE-2024-33139 | 7.5 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the findpage function Affected: 2.7.0 |
| CVE-2024-33148 | 7.3 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the list function Affected: 2.7.0 |
| CVE-2024-35082 | 6.3 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml Affected: 2.7.0 |
| CVE-2024-35085 | 5.4 | May 23 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml Affected: 2.7.0 |
| CVE-2023-2476 | 5.4 | May 2 | Dromara J2eeFAST Announcement cross site scripting Affected: through 2.6.0 |
| CVE-2023-2475 | 5.4 | May 2 | Dromara J2eeFAST System Message cross site scripting Affected: through 2.6.0 |
| CVE-2024-33161 | 5.3 | May 7 | J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the unallocatedList() function Affected: 2.7.0 |
Showing 21