408 matches found
CVE-2020-13929
Apache Zeppelin = 0.10.1. If upgrading is not feasible, apply vendor/workaround guidance from the advisory. Note: exploitation details are not provided in the sources; no in-the-wild exploit data is included in the documents beyond the stated vulnerability description. Further public technical de...
PT-2021-9680 · Apache · Apache Zeppelin
Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 and prior versions Description: The issue is an authentication bypass vulnerability that allows an attacker to bypass the Zeppelin authentication mechanism and act as another user. Recommendations: For Apache...
CVE-2021-27578 Cross Site Scripting in markdown interpreter
Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0...
Apache Zeppelin 跨站脚本漏洞
Apache Zeppelin is a web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. An xss vulnerability exists. An attacker could exploit this vulnerability to inject malicious scripts...
CVE-2020-13929 Notebook permissions bypass
Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...
CVE-2019-10095 bash command injection in spark interpreter
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...
GHSA-VRW4-W73R-6MM8 TimelockController vulnerability in OpenZeppelin Contracts
Impact A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open"...
CVE-2021-39167
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...
A Tip For Easy SQL-based Big Data Analysis: Use a Temporary Dataset
Every once in a while we’re required to analyze big data on a wide time range. Here’s a common example: “Can you analyze what happened during 2020? And don’t forget to compare it to 2019”. Questions like this are hard to answer in the big data world: Queries may take a long time to process - and...
Install Apache Zeppelin and connect it to AWS Athena for data exploration, visualization and collaboration
Introduction Apache Zeppelin is a Web-based, open source, notebook system that enables data-driven, interactive data analytics and collaborative documents with SQL. At Imperva Research Group we use it on a daily basis to query data from the Threat Research Data Lake using AWS Athena query engine...
PT-2020-12961 · Apache +1 · Dolphinscheduler +2
Name of the Vulnerable Software and Affected Versions: DolphinScheduler versions 1.2.0 through 1.2.1 Apache Zeppelin versions prior to 0.11.1 Description: A remote code execution issue exists when choosing MySQL as the database, potentially allowing an attacker to inject sensitive configuration o...
Mail.ru: Незащищённый экземпляр Zeppelin
Apache Zeppelin notebook at http://zp.premras2.m.smailru.net was made externally available due to coincidence of multiple misconfigurations...
Zeppelin Ransomware Returns with New Trojan on Board
The Zeppelin ransomware has sailed back into relevance, after a hiatus of several months. A wave of attacks were spotted in August by Juniper Threatlab researchers, making use of a new trojan downloader. These, like an initial Zeppelin wave observed in late 2019, start with phishing emails with...
zeppelin-ballastwatertreatment.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1122294 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
New Zeppelin Ransomware Targeting Tech and Health Companies
A new variant of Vega ransomware family, dubbed Zeppelin, has recently been spotted in the wild targeting technology and healthcare companies across Europe, the United States, and Canada. However, if you reside in Russia or some other ex-USSR countries like Ukraine, Belorussia, and Kazakhstan,...
Command Execution Vulnerability in the Zeppelin Platform
Apache Zeppelin is a web-based open source framework that makes interactive data analysis feasible.Zeppelin provides data analysis, data visualization and other features. A command execution vulnerability exists in the Zeppelin platform that can be exploited by an attacker to gain server privileg...
zeppelin-museum.dk Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-939899 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting zeppelin-museum.dk website an...
Session Fixation
Apache Zeppelin is vulnerable to session fixation attacks. A remote attacker could exploit a flaw in the logout function to hijack a valid user session...
