org.apache.zeppelin:zeppelin-flink-cmd (>=0.10.0 <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.10.0 <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.10.0 <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.11.2 Source cves: CVE-2024-51775 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-11444035...

Security Bulletin: IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities.

Summary IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32007 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to execute arbitrary commands on the...

Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...

PT-2023-8745 · Apache · Apache Spark

Name of the Vulnerable Software and Affected Versions: Apache Spark versions prior to 3.4.0 Description: The issue is related to insecure privilege management in the spark-submit function of Apache Spark. This allows an application to execute code with the privileges of the submitting user by...

Deserialization of untrusted data

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...

CVE-2017-12612

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...