Vulnerabilidades de Shaiwz
CVEs publicadas que afetam produtos de Shaiwz: 2 registro(s), com severidade, exploração e correções.
CVE-2026-111696
Média · 6.5
CWE-321 16/10/2026
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in...
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
CVE-2026-111695
Alta · 7.1
CWE-639 16/10/2026
Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.