273 matches found
Apache Zeppelin 跨站脚本漏洞
Apache Zeppelin is a web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. An xss vulnerability exists. An attacker could exploit this vulnerability to inject malicious scripts...
CVE-2019-10095
Apache Zeppelin
PT-2021-17518 · Apache · Apache Zeppelin
Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions prior to 0.9.0 Description: The issue is a Cross Site Scripting vulnerability in the markdown interpreter of Apache Zeppelin, allowing an attacker to inject malicious scripts. Recommendations: For versions prior to...
Apache Zeppelin 命令注入漏洞
Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation. The application supports interactive data analysis and collaborative documentation. Apache Zeppelin 0.9.0 and earlier versions contain a command injection vulnerability that could be exploited by an attack...
PT-2021-9680 · Apache · Apache Zeppelin
Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 and prior versions Description: The issue is an authentication bypass vulnerability that allows an attacker to bypass the Zeppelin authentication mechanism and act as another user. Recommendations: For Apache...
CVE-2019-10095 bash command injection in spark interpreter
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions...
A Tip For Easy SQL-based Big Data Analysis: Use a Temporary Dataset
Every once in a while we’re required to analyze big data on a wide time range. Here’s a common example: “Can you analyze what happened during 2020? And don’t forget to compare it to 2019”. Questions like this are hard to answer in the big data world: Queries may take a long time to process - and...
Install Apache Zeppelin and connect it to AWS Athena for data exploration, visualization and collaboration
Introduction Apache Zeppelin is a Web-based, open source, notebook system that enables data-driven, interactive data analytics and collaborative documents with SQL. At Imperva Research Group we use it on a daily basis to query data from the Threat Research Data Lake using AWS Athena query engine...
PT-2020-12961 · Apache +1 · Dolphinscheduler +2
Name of the Vulnerable Software and Affected Versions: DolphinScheduler versions 1.2.0 through 1.2.1 Apache Zeppelin versions prior to 0.11.1 Description: A remote code execution issue exists when choosing MySQL as the database, potentially allowing an attacker to inject sensitive configuration o...
Command Execution Vulnerability in the Zeppelin Platform
Apache Zeppelin is a web-based open source framework that makes interactive data analysis feasible.Zeppelin provides data analysis, data visualization and other features. A command execution vulnerability exists in the Zeppelin platform that can be exploited by an attacker to gain server privileg...
Session Fixation
Apache Zeppelin is vulnerable to session fixation attacks. A remote attacker could exploit a flaw in the logout function to hijack a valid user session...
GHSA-R2V5-5VCR-H3VQ Cross-site Scripting in Apache Zeppelin
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...
GHSA-C538-924G-99Q4 Session Fixation in Apache Zeppelin
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...
Session Fixation in Apache Zeppelin
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...
Improper Authentication in Apache Zeppelin
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...
GHSA-9X2H-HVG6-4R5P Improper Authentication in Apache Zeppelin
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...
Cross-site Scripting (XSS)
Apache Zeppelin is vulnerable to cross-site scripting XSS. The attack exists because it does not sanitize Note permissions, allowing an attacker to inject arbitrary script through the affected parameter...
Cross site scripting
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...