GHSA-HX5G-8HQ2-8X4W SQL Injection in Kylin

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

CVE-2020-13926

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

Sql injection

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

CVE-2020-13926

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

PT-2020-13785

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 2.0 through 3.0 Description The issue allows for SQL injection attacks due to the concatenation and execution of Hive SQL in Hive CLI or beeline when building a new segment. Some parts of the HQL are from system...

CVE-2020-13926: Improper Neutralization of Special Elements used in an SQL Command

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.9.0)

org.apache.hive:hive-exec MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-hwi (0.8.1) +1 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-service (0.8.1)

org.apache.hive:hive-service MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-service and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-hwi 0.8.1 - org.apache.hive:hive-jdbc 0.8.1 Sourc...

org.apache.hive:hive-cli (0.8.1), org.apache.hive:hive-contrib (0.8.1) +4 more potentially affected by CVE-2018-11777 via org.apache.hive:hive-exec (0.8.1)

org.apache.hive:hive-exec MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - org.apache.hive:hive-cli 0.8.1 - org.apache.hive:hive-contrib 0.8.1 - org.apache.hive:hive-hbase-handler 0.8....