CVE-2024-31863

CVE-2024-31863 affects Apache Zeppelin. The vulnerability allows authentication bypass by spoofing through replacing existing notes/annotations, effectively bypassing permissions. Affected: Zeppelin 0.10.1 before 0.11.0. Impact: potential unauthorized access via note/annotation replacement. Mitig...

CVE-2022-47894

Apache Zeppelin SAP contains an input validation weakness (related to XML processing) that affects versions 0.8.0 through 0.11.0 (per sources noting 0.8.0–0.11.0). The root cause is improper XML validation, which in some sources is described as XML External Entity (XXE) related. Impact statements...

CVE-2022-46870

CVEs summary: CVE-2022-46870 is a cross-site scripting (XSS) vulnerability in Apache Zeppelin up to version 0.8.2. The issue stems from improper neutralization of input during web page generation, allowing logged-in users to execute arbitrary JavaScript in other users’ browsers. Affected product:...

CVE-2024-31862

CVE-2024-31862 affects Apache Zeppelin (0.10.1–before 0.11.0) and is due to improper input validation when creating a new note via the Zeppelin UI. The issue is described across multiple sources as an input validation error with potential impact limited to availability (Low) and no confidentialit...

CVE-2021-28656

CVE-2021-28656 corresponds to a CSRF issue in the Credential page of Apache Zeppelin (affected versions: 0.9.0 and prior). The root cause cited across sources is inadequate validation of requests, enabling an attacker to submit malicious requests (e.g., via phishing). Several connected documents ...