444 matches found
CVE-2021-39167
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...
A Tip For Easy SQL-based Big Data Analysis: Use a Temporary Dataset
Every once in a while we’re required to analyze big data on a wide time range. Here’s a common example: “Can you analyze what happened during 2020? And don’t forget to compare it to 2019”. Questions like this are hard to answer in the big data world: Queries may take a long time to process - and...
Install Apache Zeppelin and connect it to AWS Athena for data exploration, visualization and collaboration
Introduction Apache Zeppelin is a Web-based, open source, notebook system that enables data-driven, interactive data analytics and collaborative documents with SQL. At Imperva Research Group we use it on a daily basis to query data from the Threat Research Data Lake using AWS Athena query engine...
PT-2020-12961 · Apache +1 · Dolphinscheduler +2
Name of the Vulnerable Software and Affected Versions: DolphinScheduler versions 1.2.0 through 1.2.1 Apache Zeppelin versions prior to 0.11.1 Description: A remote code execution issue exists when choosing MySQL as the database, potentially allowing an attacker to inject sensitive configuration o...
Mail.ru: Незащищённый экземпляр Zeppelin
Apache Zeppelin notebook at http://zp.premras2.m.smailru.net was made externally available due to coincidence of multiple misconfigurations...
Zeppelin Ransomware Returns with New Trojan on Board
The Zeppelin ransomware has sailed back into relevance, after a hiatus of several months. A wave of attacks were spotted in August by Juniper Threatlab researchers, making use of a new trojan downloader. These, like an initial Zeppelin wave observed in late 2019, start with phishing emails with...
zeppelin-ballastwatertreatment.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1122294 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
New Zeppelin Ransomware Targeting Tech and Health Companies
A new variant of Vega ransomware family, dubbed Zeppelin, has recently been spotted in the wild targeting technology and healthcare companies across Europe, the United States, and Canada. However, if you reside in Russia or some other ex-USSR countries like Ukraine, Belorussia, and Kazakhstan,...
Command Execution Vulnerability in the Zeppelin Platform
Apache Zeppelin is a web-based open source framework that makes interactive data analysis feasible.Zeppelin provides data analysis, data visualization and other features. A command execution vulnerability exists in the Zeppelin platform that can be exploited by an attacker to gain server privileg...
zeppelin-museum.dk Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-939899 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting zeppelin-museum.dk website an...
Session Fixation
Apache Zeppelin is vulnerable to session fixation attacks. A remote attacker could exploit a flaw in the logout function to hijack a valid user session...
Cross-site Scripting in Apache Zeppelin
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...
GHSA-R2V5-5VCR-H3VQ Cross-site Scripting in Apache Zeppelin
Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph"...
GHSA-C538-924G-99Q4 Session Fixation in Apache Zeppelin
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...
Session Fixation in Apache Zeppelin
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone"...
Improper Authentication in Apache Zeppelin
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...
GHSA-9X2H-HVG6-4R5P Improper Authentication in Apache Zeppelin
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication...
Cross-site Scripting (XSS)
Apache Zeppelin is vulnerable to cross-site scripting XSS. The attack exists because it does not sanitize Note permissions, allowing an attacker to inject arbitrary script through the affected parameter...
Authentication Bypass
zeppelin-zengine is vulnerable to authentication bypass. The vulnerability exists as users could execute paragraphs as other users without authentication due to the value of cronExecutionUser...
