Insecure Random Number Generation

zeppelin is vulnerable to insecure random number generation. It is insecure because it generates predictable random numbers using java.util.Random rather than using a cryptographically secure random number generator...

SQL Injection

zeppelin-server is vulnerable to SQL injection attacks. The username value is used directly in a SQL statement when retrieving a user list through rest. If an attacker was able to save a username with SQL code in it, this would get executed when the list was being retrieved...

Cross-Site WebSocket Hijack

zeppelin-server is vulnerable to cross-site websocket hijacking because the websockets are not restrained by the same-origin policy. This could allow an attacker to create a malicious website and trick the user into opening it...

zeppelin-museum.dk XSS vulnerability

Vulnerable URL: http://www.zeppelin-museum.dk/main.php?page=base"=buttlar⊂=crew〈=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 11430067 VIP website status:| No Check...