Apache Zeppelin 输入验证错误漏洞

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. An input validation error vulnerability exists in Apache Zeppelin that stems from the presence of an incorrect input...

4337-snap (>=0.1.0 <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5) +1275 more potentially affected by CVE-2022-35961 via @openzeppelin/contracts (>=4.1.0 <=4.7.2)

@openzeppelin/contracts NPM version =4.1.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =1.0.2, =4.0.0, =4.0.1, =2.0.0, =3.1.0 and more Source cves: CVE-2022-35961 Source advisory: OSV:GHSA-4H98-2769-GH6H...

CISA and FBI issue alert about Zeppelin ransomware

The Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA have released a joint Cybersecurity Advisory CSA about Zeppelin ransomware. The advisory contains indicators of compromise IOCs and tactics, techniques, and procedures TTPs associated with...

Zeppelin ransomware target organization in Europe and USA

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Zeppelin, the newest member of the Delphi-based Vega ransomware family, has been quite clever in meticulously tailoring these ransomware operations. Zeppelin, first identified in 2019 as ransomware-as-a-service...

@aragon/core-contracts (>=0.3.0-alpha <=3.0.0-alpha), @benddao/bend-downpayment (=1.0.0) +21 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts-upgradeable (>=4.6.0 <=4.7.0)

@openzeppelin/contracts-upgradeable NPM version =4.6.0, =0.3.0-alpha, =1.2.0, =0.0.2, =0.1.0, =0.1.6, =0.1.0, =0.2.0 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

@0xabcdefg/smart-order-router (>=1.0.0 <=1.0.5), @0xabcdefg/universal-router-sdk (>=1.0.0 <=1.0.2) +903 more potentially affected by CVE-2022-35916 via @openzeppelin/contracts (>=4.6.0 <=4.7.1)

@openzeppelin/contracts NPM version =4.6.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =1.0.0, =0.2.0, =4.14.3, =2.0.17, =0.0.1, =0.0.1, =0.0.1, =0.0.17 and more Source cves: CVE-2022-35916 Source advisory: OSV:GHSA-9J3M-G383-29QR...

Feds: Zeppelin Ransomware Resurfaces with New Compromise, Encryption Tactics

Zeppelin ransomware is back and employing new compromise and encryption tactics in its recent campaigns against various vertical industries—particularly healthcare—as well as critical infrastructure organizations, the feds are warning. Threat actors deploying the ransomware as a service RaaS are...

#StopRansomware: Zeppelin Ransomware

Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce multifactor authentication. Note: this joint Cybersecurity Advisory CSA is part of an...

#StopRansomware: Zeppelin Ransomware

CISA and the Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory CSA, StopRansomware: Zeppelin Ransomware, to provide information on Zeppelin Ransomware. Actors use Zeppelin Ransomware, a ransomware-as-a-service RaaS, against a wide range of businesses and critical...

org.apache.geode:geode-lucene (=1.1.0), org.apache.geode:geode-modules (=1.1.0) +5 more potentially affected by CVE-2017-5649 via org.apache.geode:geode-core (=1.1.0)

org.apache.geode:geode-core MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.geode:geode-core and may be impacted: - org.apache.geode:geode-lucene =1.1.0 - org.apache.geode:geode-modules =1.1.0 -...

0x-hunter-core (>=1.0.0-33 <=1.0.0-38), 1155-to-20 (>=1.0.0 <=1.0.2) +2830 more potentially affected by CVE-2021-46320 via @openzeppelin/contracts (>=2.3.0 <=4.4.0)

@openzeppelin/contracts NPM version =2.3.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.12.0 - @0xkkkkkkkkkkkkkkk/dodo =2.0.1 and more Source cves: CVE-2021-46320 Source advisory: OSV:GHSA-88G8-F5MF-F5RJ...

No use of reentrency guards

Handle jayjonah8 Vulnerability details Impact The README.md makes the point that reentrancy attacks are a cause for concern, but the protocol makes no use of reentrancy guards in any file or in the functions users interact with. Proof of Concept The are no Reentrancy guards in the entire code bas...

Multicall.sol batch calls don't update msg.value

Handle jayjonah8 Vulnerability details Impact In NestedFactory.sol using Multicall.sol can be dangerous when it has a msg.value inside a loop since the msg.value doesn't update every iteration. This can lead to a user sending ETH one time and it being counted for every iteration. There is a...

zeppelin-tourismus.de Cross Site Scripting vulnerability OBB-2150200

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

GHSA-87P2-CVHQ-Q4MV Authentication bypass in Apache Zeppelin

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

Authentication bypass in Apache Zeppelin

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

GHSA-4QW8-PGPR-P9MQ Bash command injection in Apache Zeppelin

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

Bash command injection in Apache Zeppelin

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...

GHSA-MF7Q-GW5F-Q8JJ Cross-site Scripting in Apache Zeppelin

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0...

Cross-site Scripting in Apache Zeppelin

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0...