CVE-2024-31864

CVE-2024-31864 affects Apache Zeppelin prior to 0.11.1, enabling code injection when establishing a MySQL JDBC connection. The issue is described as improper control of generation of code, with a CVSS v3.1 base score of 9.8 (Network, HIGH impact on confidentiality, integrity, and availability). T...

CVE-2024-31866

CVE-2024-31866 is an Apache Zeppelin vulnerability: improper encoding/escaping of output allowing an attacker to override configuration (notably ZEPPELIN_INTP_CLASSPATH_OVERRIDES) to execute shell commands or malicious code. Affects Zeppelin releases from 0.8.2 up to but not including 0.11.1; upg...