CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

• CWE-89

• http://www.securityfocus.com/bid/91795Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2016:1428Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1429Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1349990Issue Tracking
• https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524bThird Party Advisory
• https://issues.jboss.org/browse/DASHBUILDE-113Permissions Required
• http://www.securityfocus.com/bid/91795Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2016:1428Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1429Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1349990Issue Tracking
• https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524bThird Party Advisory
• https://issues.jboss.org/browse/DASHBUILDE-113Permissions Required

Published

Aug 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4993CRLF injection vulnerability in the Undertow web server in W…
• CVE-2016-4994Use-after-free vulnerability in the xcf_load_image function …7.8
• CVE-2016-4995Foreman before 1.11.4 and 1.12.x before 1.12.1 does not prop…
• CVE-2016-4996discovery-debug in Foreman before 6.2 when the ssh service h…
• CVE-2016-4997The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsoc…7.8
• CVE-2016-4998The IPT_SO_SET_REPLACE setsockopt implementation in the netf…
• CVE-2016-5000The XLSX2CSV example in Apache POI before 3.14 allows remote…
• CVE-2016-5001This is an information disclosure vulnerability in Apache Ha…
• CVE-2016-5002XML external entity (XXE) vulnerability in the Apache XML-RP…
• CVE-2016-5003The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in…
• CVE-2016-5004The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 …
• CVE-2016-5005Cross-site scripting (XSS) vulnerability in Apache Archiva 1…