Apache Zeppelin 代码注入漏洞

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from a code injection vulnerability that stems from the application's failure to properly filter...

PT-2024-24248 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 through 0.10.x Description: The issue is related to improper input validation, allowing attackers to access files in the filesystem by adding relative path indicators e.g ... This enables them to see the content...

Apache Zeppelin 安全漏洞

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin has a code execution vulnerability that can be exploited by an attacker to execute shell scripts or malicio...

Apache Zeppelin 跨站请求伪造漏洞

Apache Zeppelin is an open source web-based laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. A cross-site request forgery vulnerability exists in Apache Zeppelin version 0.9.0 and earlier, which stems from a...

Zeppelin: Multiple Vulnerabilities

Background Apache Zeppelin is a web-based notebook that enables data-driven, interactive data analytics and collaborative documents with SQL, Scala, Python, R and more. Description Multiple vulnerabilities have been discovered in Zeppelin. Please review the CVE identifiers referenced below for...

GLSA-202311-04 : Zeppelin: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202311-04 Zeppelin: Multiple Vulnerabilities - bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppeli...

Rhysida Ransomware

Rhysida Ransomware By Alexandre Mundo, Max Kersten, and Leandro Velasco · October 9, 2023 New ransomware victims are made every day by ransom gangs with a variety of ransomware malware families, one of which is the Rhysida ransomware family. Within this blog, an anonymised version of an attack by...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1546 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts (>=4.0.0 <=4.9.2)

@openzeppelin/contracts NPM version =4.0.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-40014 Source advisory: OSV:GHSA-G4VP-M682-QQMP...

GHSA-GM67-H5WR-W3CV Apache Zeppelin Improper Input Validation vulnerability

The improper Input Validation vulnerability in Move folder to Trash feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

Apache Zeppelin Improper Input Validation vulnerability

The improper Input Validation vulnerability in Move folder to Trash feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1441 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts (>=4.3.0 <=4.8.2)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-30542 Source advisory: OSV:GHSA-93HQ-5WGC-JC82...

Brazil’s manufacturing industry under attack by Vice Society ransomware group

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Vice Society ransomware group is a cyber threat group that made headlines in late 2022 and early 2023 for a series of attacks against various targets, including the rapid transit system in San...

GHSA-9P8J-HRGF-JC2G Apache Zeppelin Cross-site Scripting vulnerability

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

Apache Zeppelin Cross-site Scripting vulnerability

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2022-89420)

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. The application supports interactive data analysis and collaborative documentation. versions of Apache Zeppelin prior to 0.8.2 contai...

Apache Zeppelin input validation error vulnerability

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. Apache Zeppelin is vulnerable to an input validation error that results from improper input validation in its Move folder to Trash...

Cross-site Scripting (XSS)

zeppelin-web is vulnerable to cross-site scripting. The vulnerability exists because the WebsocketEventFactory function in websocket-event.factory.js does not properly escape the message attribute before being rendered, allowing an attacker to inject and execute malicious JavaScript...

Arbitrary File Deletion

zeppelin-server is vulnerable to Arbitrary File Deletion. The vulnerability exists due to the improper input validation in the moveFolderToTrash function of NotebookService.java, allowing an attacker to delete arbitrary files...

CVE-2022-46870

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported...

CVE-2021-28655

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...