ZE
Product
Zeppelin
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 19Low 0
Watch
Add Zeppelin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-31866 | 9.8 | Apr 9 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin Affected: 0.8.2 before 0.11.1 |
| CVE-2024-31864 | 9.8 | Apr 9 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin Affected: before 0.11.1 |
| CVE-2019-10095 | 9.8 | Sep 2 | bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings Affected: through 0.9.0 |
| CVE-2018-1317 | 8.8 | Apr 23 | In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication Affected: before 0.8.0 |
| CVE-2017-12619 | 8.1 | Apr 23 | Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session Affected: before 0.7.3 |
| CVE-2024-41169 | 7.5 | Jul 12 | The attacker can use the raft server protocol in an unauthenticated way Affected: 0.10.1 before 0.12.0 |
| CVE-2020-13929 | 7.5 | Sep 2 | Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user Affected: through 0.9.0 |
| CVE-2026-44615 | 6.5 | Jul 31 | Path traversal in NotebookRepo note and folder path composition Affected: 0.9.0 before 0.12.1 |
| CVE-2026-44617 | 6.5 | Jul 30 | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 Affected: 0.11.1 before 0.12.1 |
| CVE-2026-44616 | 6.5 | Jul 30 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction Affected: 0.6.0 before 0.12.1 |
| CVE-2024-31867 | 6.5 | Apr 9 | Improper Input Validation vulnerability in Apache Zeppelin Affected: 0.8.2 before 0.11.1 |
| CVE-2024-31865 | 6.5 | Apr 9 | Improper Input Validation vulnerability in Apache Zeppelin Affected: 0.8.2 before 0.11.1 |
| CVE-2024-31860 | 6.5 | Apr 9 | Improper Input Validation vulnerability in Apache Zeppelin Affected: 0.9.0 before 0.11.0 |
| CVE-2021-28655 | 6.5 | Dec 16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files Affected: through 0.9.0 |
| CVE-2026-44613 | 6.1 | Jul 30 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling Affected: 0.6.0 before 0.12.1 |
| CVE-2024-41177 | 6.1 | Aug 3 | Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin Affected: before 0.12.0 |
| CVE-2024-31868 | 6.1 | Apr 9 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin Affected: 0.8.2 before 0.11.1 |
| CVE-2021-27578 | 6.1 | Sep 2 | Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts Affected: before 0.9.0 |
| CVE-2018-1328 | 6.1 | Apr 23 | Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions Affected: before 0.8.0 |
| CVE-2021-28656 | 5.4 | Apr 9 | Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request Affected: through 0.9.0 |
| CVE-2022-46870 | 5.4 | Dec 16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in… Affected: before 0.8.2 |
| CVE-2024-51775 | 5.3 | Aug 3 | Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin Affected: 0.11.0 before 0.12.0 |
| CVE-2024-52279 | 5.3 | Aug 3 | Improper Input Validation vulnerability in Apache Zeppelin Affected: 0.11.1 before 0.12.0 |
| CVE-2024-31863 | 5.3 | Apr 9 | Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0 Affected: 0.10.1 |
| CVE-2024-31862 | 5.3 | Apr 9 | Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0 Affected: 0.10.1 before 0.11.0 |
| CVE-2022-47894 | 5.3 | Apr 9 | Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0 Affected: 0.8.0 before 0.11.0 |
Showing 26