407 matches found
CVE-2026-44613
Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...
CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...
CVE-2026-44613
Apache Zeppelin exposes CSRF in REST and WebSocket request handling due to default CORS configuration that allows cross-origin state-changing requests and text/plain bodies. Affected versions are 0.6.0 through 0.12.0; upgrade to 0.12.1 to fix the issue. The CVE describes an attacker luring an aut...
CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...
PT-2026-66503
Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description An LDAP injection issue exists where the ActiveDirectoryGroupRealm constructs LDAP search filters without escaping user-controlled input. This allows an authenticated attacker to inject...
PT-2026-66502
Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description A Cross-Site Request Forgery CSRF issue exists due to a default CORS Cross-Origin Resource Sharing configuration that permits cross-origin state-changing requests and accepts text/plain...
PT-2026-66504
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...
CVE-2021-27578
Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0...
CVE-2024-41169
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue by removin...
CVE-2024-41177
Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue...
EUVD-2021-1977
Malware in sbrugna...
EUVD-2019-0414
Malware in sbrugna...
EUVD-2019-0415
Malware in sbrugna...
EUVD-2021-2014
Malware in sbrugna...
EUVD-2019-0431
Malware in sbrugna...
EUVD-2021-2094
Malware in sbrugna...
EUVD-2024-1153
Malicious code in bioql PyPI...
EUVD-2024-1270
Malicious code in bioql PyPI...