Approved changes feed: RSS · Atom
cpe:2.3:a:apache:zeppelin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Zeppelin (8ebfa5e2-803f-5e40-863f-1189fd537a08) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/zeppelin |
purl2cpe | 2026-06-01 10:14:30.542888 |
pkg:docker/apache/zeppelin |
purl2cpe | 2026-06-01 10:14:30.542891 |
pkg:github/apache/zeppelin |
purl2cpe | 2026-06-01 10:14:30.542894 |
pkg:maven/org.apache.zeppelin/zeppelin |
purl2cpe | 2026-06-01 10:14:30.542897 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52279 |
vulnerable | 2026-06-08 06:52:14.706596 |
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Published: 2025-08-03T10:02:05.153Z
Updated: 2025-11-04T21:09:03.247Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51775 |
vulnerable | 2026-06-08 06:52:12.808639 |
Apache Zeppelin: Command Injection via CSWSH
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Published: 2025-08-03T10:13:17.467Z
Updated: 2025-11-04T21:09:01.910Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41177 |
vulnerable | 2026-06-08 06:43:54.254185 |
Apache Zeppelin: XSS in the Helium module
Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.
This issue affects Apache Zeppelin: before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
Published: 2025-08-03T10:09:43.302Z
Updated: 2025-11-04T21:08:43.404Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41169 |
vulnerable | 2026-06-08 06:43:54.223636 |
Apache Zeppelin: raft directory listing and file read
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.
This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
Published: 2025-07-12T16:22:35.724Z
Updated: 2025-11-04T21:08:42.107Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31868 |
vulnerable | 2026-06-08 06:35:32.192403 |
Apache Zeppelin: XSS vulnerability in the helium module
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin.
The attackers can modify helium.json and exposure XSS attacks to normal users.
This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which fixes the issue.
Published: 2024-04-09T16:10:30.671Z
Updated: 2024-11-04T16:12:40.294Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31867 |
vulnerable | 2026-06-08 06:35:32.192002 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31866 |
vulnerable | 2026-06-08 06:35:32.191474 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31865 |
vulnerable | 2026-06-08 06:35:32.190763 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31864 |
vulnerable | 2026-06-08 06:35:32.188703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31862 |
vulnerable | 2026-06-08 06:35:32.185831 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31860 |
vulnerable | 2026-06-08 06:35:32.185125 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47894 |
vulnerable | 2026-06-08 05:50:40.948567 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46870 |
vulnerable | 2026-06-08 05:50:39.679147 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28656 |
vulnerable | 2026-06-08 05:31:24.692630 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28655 |
vulnerable | 2026-06-08 05:31:24.692253 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27578 |
vulnerable | 2026-06-08 05:31:21.800309 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13929 |
vulnerable | 2026-06-08 05:18:01.390124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10095 |
vulnerable | 2026-06-08 05:12:22.235497 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1328 |
vulnerable | 2026-06-08 05:11:17.724068 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1317 |
vulnerable | 2026-06-08 05:11:17.678320 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12619 |
vulnerable | 2026-06-08 05:08:47.383773 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.