CVE-2018-1328

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2018-1328

CVE-2018-1328 affects Apache Zeppelin prior to 0.8.0, where a stored XSS flaw exists via Note permissions. The root cause is unsanitized input in Note handling that can trigger script execution. Impact is user-facing XSS; remediation is upgrading Zeppelin to 0.8.0 or later (or applying equivalent...

CVE-2018-1328

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...

CVE-2018-1317

CVE-2018-1317 affects Apache Zeppelin prior to 0.8.0, where the cron scheduler was enabled by default. This could allow users to run paragraphs as other users without authentication, constituting an authentication bypass. The documented remediation is to upgrade to Zeppelin 0.8.0 or later, which ...

CVE-2018-1317

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...

CVE-2017-12619

CVE-2017-12619 affects Apache Zeppelin prior to 0.7.3, where a session fixation flaw could allow an attacker to hijack a valid user session. The issue is documented across multiple sources (NVD entry for CVE-2017-12619 and OSV/GHSA advisories) and is commonly described as a session fixation vulne...

CVE-2017-12619

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. It does not sanitized the username but directly getting input from user in the SQL query when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was bein...

Sensitive Information Exposure

Zeppelin: JDBC interpreter is vulnerable to sensitive information exposure. The vulnerability exists because it does not redact the credentials in interpreter settings page and stores as plaintext in the configuration files...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...

Insecure Random Number Generation

zeppelin is vulnerable to insecure random number generation. It is insecure because it generates predictable random numbers using java.util.Random rather than using a cryptographically secure random number generator...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. The username value is used directly in a SQL statement when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was being retrieved...

Cross-Site WebSocket Hijack

zeppelin-server is vulnerable to cross-site websocket hijacking because the websockets are not restrained by the same-origin policy. This could allow an attacker to create a malicious website and trick the user into opening it...

zeppelin-museum.dk XSS vulnerability

Vulnerable URL: http://www.zeppelin-museum.dk/main.php?page=base"=buttlar⊂=crew〈=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11430067 VIP website status:| No Check...