Advisories · Technology
Apache Software Foundation Apache Kylin.
Every CVE that names Apache Software Foundation Apache Kylin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Apache Kylin: Potential computed-column resource exhaustion
- Apache Software Foundation Apache Kylin
- Denial of service
- CVSS 7.5 High
Apache Kylin: default startup profile miss security settings
- Apache Software Foundation Apache Kylin
- CWE-1188
- CVSS 7.5 High
Apache Kylin: Potential unauthenticated job metadata replacement
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 6.5 Medium
Apache Kylin: Potential JDBC source configuration validation issue
- Apache Software Foundation Apache Kylin
- CWE-20
- CVSS 5.3 Medium
Apache Kylin: tables/names SparkSQL injection
- Apache Software Foundation Apache Kylin
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- Apache Software Foundation Apache Kylin
- Authentication bypass
- CVSS 6.5 Medium
Apache Kylin: missing JDBC-config authorization
- Apache Software Foundation Apache Kylin
- Broken access control
- CVSS 6.5 Medium
Apache Kylin: job-driver UI proxy SSRF
- Apache Software Foundation Apache Kylin
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Apache Kylin: delete metadata backup path-confinement bypass
- Apache Software Foundation Apache Kylin
- Path traversal
- CVSS 8.8 High
Apache Kylin: spark job OS command injection
- Apache Software Foundation Apache Kylin
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
- Apache Software Foundation Apache Kylin
- Authentication bypass
- CVSS 7.5 High
Apache Kylin: Broken Access Control in QuerySQLBlacklistController
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
Apache Kylin: JobController allows unauthorized cross-project manipulation
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 7.5 High
Apache Kylin: Unauthorized cross-project job discard
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: Unauthenticated Metastore Cleanup
- Apache Software Foundation Apache Kylin
- Authentication bypass
- CVSS 7.5 High
Apache Kylin: Unauthorized SQL execution to Spark SQL env
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 8.8 High
Apache Kylin: JDBC URL Whitelist Verification Bypass
- Apache Software Foundation Apache Kylin
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: Missing authentication on certain cache API endpoints
- Apache Software Foundation Apache Kylin
- SQL injection
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: Redis unsafe Java deserialization
- Apache Software Foundation Apache Kylin
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Kylin: Missing authorization and path-confinement on system meta dump
- Apache Software Foundation Apache Kylin
- Broken access control
- CVSS 7.5 High
Apache Kylin: Low-Privilege Config Exposure
- Apache Software Foundation Apache Kylin
- Information disclosure
- CVSS 4.3 Medium
Apache Kylin: Improper authorization in job information retrieval
- Apache Software Foundation Apache Kylin
- CWE-280
- CVSS 8.8 High
Apache Kylin: OS Command Injection via Async Query API
- Apache Software Foundation Apache Kylin
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
- Apache Software Foundation Apache Kylin
- SQL injection