Directory Traversal

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Directory Traversal through the...

LDAP Injection

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to LDAP Injection through the...

Cross-site Request Forgery (CSRF)

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF...

LDAP Injection

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to LDAP Injection through the...

io.javalin:javalin-bundle (>=6.6.0, <=6.7.0), io.javalin:javalin-micrometer (>=6.6.0, <=6.7.0) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.14.2, <=1.14.5)

io.micrometer:micrometer-jetty11 MAVEN version =1.14.2, =6.6.0, =6.6.0, =6.7.0 - org.apache.zeppelin:zeppelin-server 0.12.1 Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...

io.javalin:javalin-bundle (>=6.6.0, <=6.7.0), io.javalin:javalin-micrometer (>=6.6.0, <=6.7.0) +1 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.14.2, <=1.14.5)

io.micrometer:micrometer-jetty11 MAVEN version =1.14.2, =6.6.0, =6.6.0, =6.7.0 - org.apache.zeppelin:zeppelin-server 0.12.1 Source cves: CVE-2026-40984 Source advisory: GHSA-G3PR-3P32-FP23...

io.javalin:javalin-bundle (>=5.2.0, <=6.7.0), io.javalin:javalin-micrometer (>=5.2.0, <=6.7.0) +2 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-jetty11 (>=1.10.1, <=1.14.5)

io.micrometer:micrometer-jetty11 MAVEN version =1.10.1, =5.2.0, =5.2.0, =0.13.1, =0.14.0 - org.apache.zeppelin:zeppelin-server 0.12.1 Source cves: CVE-2026-40984 Source advisory: SNYK:JAVA-IOMICROMETER-18322421...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Exposure of Sensitive System...

Denial Of Service (DoS)

org.apache.zeppelin:zeppelin-server is vulnerable to Improper Input Validation. The vulnerability is due to insufficient note path validation, which allows an attacker to cause Denial of Service...

Path Traversal

org.apache.zeppelin: zeppelin-server is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user-supplied input, allowing attackers to use relative paths e.g., ".." to access files on the server's filesystem that the server account has permissions to access...

Arbitrary File Deletion

zeppelin-server is vulnerable to Arbitrary File Deletion. The vulnerability exists due to the improper input validation in the moveFolderToTrash function of NotebookService.java, allowing an attacker to delete arbitrary files...

com.cooldatasoft:wicket-menu (>=6.10.0, <=6.10.0.4), com.cooldatasoft:wicket-menu-demo (>=6.10.0.0, <=6.10.0.4) +221 more potentially affected by CVE-2021-23937 via org.apache.wicket:wicket-core (6.10.0)

org.apache.wicket:wicket-core MAVEN version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cooldatasoft:wicket-menu =6.10.0, =6.10.0.0, =0.2, =0.0.2, =0.1.0, =0.1.0, =3.5, =3.5, =3.9 -...

com.cooldatasoft:wicket-menu (>=6.10.0, <=6.10.0.4), com.cooldatasoft:wicket-menu-demo (>=6.10.0.0, <=6.10.0.4) +221 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (6.10.0)

org.apache.wicket:wicket-core MAVEN version 6.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cooldatasoft:wicket-menu =6.10.0, =6.10.0.0, =0.2, =0.0.2, =0.1.0, =0.1.0, =3.5, =3.5, =3.9 -...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +8 more potentially affected by CVE-2016-3083 via org.apache.hive:hive-exec (0.9.0)

org.apache.hive:hive-exec MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 -...

com.nflabs.zeppelin:zeppelin-cli (>=0.1.0, <=0.1.2), com.nflabs.zeppelin:zeppelin-server (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2018-1314 via org.apache.hive:hive-jdbc (0.9.0)

org.apache.hive:hive-jdbc MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-jdbc and may be impacted: - com.nflabs.zeppelin:zeppelin-cli =0.1.0, =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2018-1314 Source advisory:...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. It does not sanitized the username but directly getting input from user in the SQL query when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was bein...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. The username value is used directly in a SQL statement when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was being retrieved...

Cross-Site WebSocket Hijack

zeppelin-server is vulnerable to cross-site websocket hijacking because the websockets are not restrained by the same-origin policy. This could allow an attacker to create a malicious website and trick the user into opening it...