446 matches found
Apache Kylin 访问控制错误漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark, etc. An access control error vulnerability exists in Apache kylin, which stems from allowing...
Apache Kylin 权限许可和访问控制问题漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache Kylin is vulnerable to permission and access control issues, which stem from the fact th...
PT-2022-1531
Name of the Vulnerable Software and Affected Versions Apache Kylin 2 versions 2.6.6 and prior Apache Kylin 3 versions 3.1.2 and prior Apache Kylin 4 versions 4.0.0 and prior Description The issue is related to the use of Class.forName... which can load any class based on user input. This can...
PT-2022-12363
Name of the Vulnerable Software and Affected Versions Apache Kylin versions 2.6.6 and prior Apache Kylin versions 3.1.2 and prior Apache Kylin versions 4.0.0 and prior Description The issue allows cross-origin requests with credentials to be sent from any origin. This could potentially lead to...
Apache Kylin 输入验证错误漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin has an input validation error vulnerability, which stems from...
Apache Kylin 命令注入漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache kylin is vulnerable to operating system command injection, which stems from the fact tha...
CVE-2021-27738: Server-Side Request Forgery (SSRF)
All request mappings in StreamingCoordinatorController.java handling /kylin/api/streamingcoordinator/ REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification...
CVE-2021-45457: Incorrect Authorization
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...
CVE-2021-45456: Improper Neutralization of Special Elements used in a Command
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...
Apache Kylin 安全特征问题漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin security vulnerability, the vulnerability stems from the user...
CVE-2021-45458: Use of Hard-coded Credentials
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their passwor...
PT-2022-12364 · Apache · Apache Kylin
Name of the Vulnerable Software and Affected Versions: Apache Kylin versions 2.6.6 and prior Apache Kylin versions 3.1.2 and prior Apache Kylin versions 4.0.0 and prior Description: Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In th...
CVE-2021-31522: Use of Externally-Controlled Input to Select Classes or Code
Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...
PT-2022-2847
Name of the Vulnerable Software and Affected Versions Apache Kylin versions prior to 3.1.2 Description The issue is related to insufficient security checks in the StreamingCoordinatorController.java component, which handles /kylin/api/streaming coordinator/ REST API endpoints. This allows an...
Apache Kylin 代码问题漏洞
Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache kylin has a server-side request forgery vulnerability, which ste...
CVE-2021-36774: Undefined Security Weakness
Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue...
kylin-chemicals.com Cross Site Scripting vulnerability OBB-2325377
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2021-5951 · Apache · Apache Kylin
Name of the Vulnerable Software and Affected Versions: Apache Kylin 2 versions 2.6.6 and prior Apache Kylin 3 versions 3.1.2 and prior Description: The issue is related to the MySQL JDBC driver in Apache Kylin, which can allow an attacker to execute arbitrary code from a malicious MySQL server...
