In Apache Zeppelin versions from 0.8.2 before 0.11.1 a medium severity vulnerability CVE-2024-31867 was detected. Attackers can exploit the system by tampering with LDAP search filter settings, allowing them to run harmful queries. To fix the issue, users should upgrade Apache Zeppelin to versions 0.11.1. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31867/.
Read more Graphic Design
In iTop a high severity vulnerability CVE-2023-48709 was detected. Users need to be careful when opening CSV or Excel files from the back office or portal as they may contain dangerous formulas that can lead to malicious code being executed on your computer, especially in Excel 2016. The issue is resolved in iTop 2.7.9, 3.0.4, 3.1.1, and 3.2.0 versions. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-48709/.
Read more IT Business Management
In iTop a critical severity vulnerability CVE-2023-48710 was detected. Due to this vulnerability files from the env-production folder, which should be restricted, were accessible, potentially exposing sensitive data from third-party modules. To address this issue, users should update iTop to versions 2.7.10, 3.0.4, 3.1.1 and 3.2.0. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-48710/.
Read more IT Business Management
In GitLab CE/EE versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 a medium severity vulnerability CVE-2023-6489 was detected. Due to a bug in GitLab’s chat integration feature lets attackers overload the system, causing slowdowns and service interruptions. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-6489/.
Read more Developer Tools
In Apache Zeppelin versions from 0.8.2 before 0.11.1 a medium severity vulnerability CVE-2024-31866 was detected. The attackers can execute shell scripts or malicious code by manipulating configurations such as ZEPPELIN_INTP_CLASSPATH_OVERRIDES, thereby gaining unauthorized access to execute potentially harmful actions. Users are recommended to upgrade to version 0.11.1, which fixes the issue. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31866/.
Read more Graphic Design
in Apache Zeppelin versions from 0.8.2 before 0.11.1 a medium severity vulnerability CVE-2024-31865 was detected. Attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. Users are recommended to upgrade to version 0.11.1, which fixes the issue. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31865/.
Read more Graphic Design
Improper Control of Code Generation (‘Code Injection’) vulnerability CVE-2024-31864 was detected in all versions of Apache Zeppelin before 0.11.1. This vulnerability allows attackers to inject sensitive configuration or malicious code when connecting MySQL database via Java Database Connectivity driver. The issue is resolved in version 0.11.1. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31864/.
Read more Graphic Design
In GitLab CE/EE all versions starting from 16.9 before 16.9.4, and from 16.10 before 16.10.2 a high severity vulnerability CVE-2024-3092 was detected. This issue allows attackers to do things on someone else’s behalf by injecting a harmful code. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-3092/.
Read more Developer Tools
In Apache Zeppelin versions from 0.10.1 before 0.11.0 an Improper Input Validation vulnerability CVE-2024-31862 was detected, particularly when creating a new note through Zeppelin’s user interface. The issue is fixed in version 0.11.0. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31862.
Read more Graphic Design