CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2018-1328

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2018-1328

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

Session fixation

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

Authentication flaw

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

CVE-2018-1328

CVE-2018-1328 affects Apache Zeppelin prior to 0.8.0, where a stored XSS flaw exists via Note permissions. The root cause is unsanitized input in Note handling that can trigger script execution. Impact is user-facing XSS; remediation is upgrading Zeppelin to 0.8.0 or later (or applying equivalent...

CVE-2018-1328

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2018-1317

CVE-2018-1317 affects Apache Zeppelin prior to 0.8.0, where the cron scheduler was enabled by default. This could allow users to run paragraphs as other users without authentication, constituting an authentication bypass. The documented remediation is to upgrade to Zeppelin 0.8.0 or later, which ...

CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

CVE-2017-12619

CVE-2017-12619 affects Apache Zeppelin prior to 0.7.3, where a session fixation flaw could allow an attacker to hijack a valid user session. The issue is documented across multiple sources (NVD entry for CVE-2017-12619 and OSV/GHSA advisories) and is commonly described as a session fixation vulne...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...