CVE-2022-45868
Published Nov 23, 2022The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in c…
Vendor/product archive
h2database / h2 CVEs
Beta · best-effort6 CVEs tagged to h2database / h2 — 2 Critical, 3 High, 1 Medium, 0 Low, 0 Unrated.
CVE-2022-23221
Published Jan 19, 2022H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSC…
CVE-2021-42392
Published Jan 10, 2022The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name…
- evidence mentions
- 4
- Buzz score
- 29.1
CVE-2021-23463
Published Dec 10, 2021The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives p…
CVE-2018-14335
Published Jul 24, 2018An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlin…
CVE-2018-10054
Published Apr 11, 2018H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position i…
Showing 1-6 of 6 CVEsPage 1 of 1