CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

CVE-2017-12619

CVE-2017-12619 affects Apache Zeppelin prior to 0.7.3, where a session fixation flaw could allow an attacker to hijack a valid user session. The issue is documented across multiple sources (NVD entry for CVE-2017-12619 and OSV/GHSA advisories) and is commonly described as a session fixation vulne...

CVE-2018-1328: Improper Neutralization of Input During Web Page Generation

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

PT-2019-8927

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue allows users to run paragraphs as other users without authentication due to the cron scheduler being enabled by default. Recommendations For versions prior to 0.8.0, update to versi...

PT-2019-7908

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.7.3 Description The issue allows an attacker to hijack a valid user session through session fixation. This was reported by "stone lone". Recommendations For versions prior to 0.7.3, update to version 0.7.3 o...

PT-2019-8947

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions prior to 0.8.0 Description The issue is related to a stored XSS problem that occurs via Note permissions. It was reported by Josna Joseph. Recommendations For versions prior to 0.8.0, update to version 0.8.0 or later t...

CVE-2018-1317: Improper Authentication

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

CVE-2017-12619: Session Fixation

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...