org.apache.kylin:kylin-tool-assembly (2.6.4), org.apache.ranger:ranger-kylin-plugin (>=2.1.0, <=2.2.0) +1 more potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.4)

org.apache.kylin:kylin-server-base MAVEN version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.4 - org.apache.ranger:ranger-kylin-plugin =2.1.0,...

org.apache.kylin:kylin-tool-assembly (2.6.3) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.3)

org.apache.kylin:kylin-server-base MAVEN version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.3 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.6.2) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.2)

org.apache.kylin:kylin-server-base MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.2 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.6.1) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.1)

org.apache.kylin:kylin-server-base MAVEN version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.1 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.6.0) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.6.0)

org.apache.kylin:kylin-server-base MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.0 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.5.2) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.5.2)

org.apache.kylin:kylin-server-base MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.5.2 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.5.1) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.5.1)

org.apache.kylin:kylin-server-base MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.5.1 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.5.0), org.apache.ranger:ranger-kylin-plugin (2.0.0) +1 more potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.5.0)

org.apache.kylin:kylin-server-base MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.5.0 - org.apache.ranger:ranger-kylin-plugin 2.0.0 -...

org.apache.kylin:kylin-tool-assembly (2.4.1) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.4.1)

org.apache.kylin:kylin-server-base MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.4.1 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.4.0) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.4.0)

org.apache.kylin:kylin-server-base MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.4.0 Source cves: CVE-2020-13925 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.3.2) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.3.2)

org.apache.kylin:kylin-server-base MAVEN version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.3.2 Source cves: CVE-2020-13925 Source advisory:...

org.apache.ranger:ranger-kylin-plugin (>=1.1.0, <=1.2.0), org.apache.ranger:ranger-kylin-plugin-shim (>=1.1.0, <=1.2.0) potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (2.3.0)

org.apache.kylin:kylin-server-base MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.ranger:ranger-kylin-plugin =1.1.0, =1.1.0, =1.2.0 Source cves: CVE-2020-13925...

SQL Injection

kylin-server-base is vulnerable to SQL injection. SQL statements are concatenated and executed in the CLI or beeline when building new segments, allowing an attacker to inject and execute arbitrary SQL statements if system configurations are overwritten via rest APIs...

org.apache.kylin:kylin-tool-assembly (>=2.1.0, <=3.0.2), org.apache.ranger:ranger-kylin-plugin (>=1.1.0, <=2.2.0) +1 more potentially affected by CVE-2020-13926 via org.apache.kylin:kylin-server-base (>=2.1.0, <=3.0.2)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.2.0 Source cves: CVE-2020-13926 Source advisory: MEND:CVE-2020-13926...

org.apache.kylin:kylin-tool-assembly (>=2.1.0, <=3.0.2), org.apache.ranger:ranger-kylin-plugin (>=1.1.0, <=2.2.0) +1 more potentially affected by CVE-2020-13925 via org.apache.kylin:kylin-server-base (>=2.1.0, <=3.0.2)

org.apache.kylin:kylin-server-base MAVEN version =2.1.0, =2.1.0, =1.1.0, =1.1.0, =2.2.0 Source cves: CVE-2020-13925 Source advisory: MEND:CVE-2020-13925...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14060 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14060 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14062 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14062 Source advisory:...

OS Command Injection

kylin-server-base is vulnerable to OS Command Injection. The vulnerability exists as the values of srcCfgUri, dstCfgUri, and projectName, in CubeService.java is not properly handled...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +30952 more potentially affected by CVE-2020-11113 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-11113 Source advisory:...

SQL Injection

kylin-server-base is vulnerable to SQL injection. User input to some RESTful APIs is not validated and sanitized before being concatenated to SQL queries. This allows an attacker to inject and execute arbitrary SQL statements in the database...