Read the docs

h2database

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

h2database records in CISA KEV

No h2database vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
H2 6 records CRITICAL

Records

6 records in H2 · all components

TI-2022-07362 CVE-2022-23221 · GHSA-45hx-wfhj-473x

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a…

Priority CRITICAL 85

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64766 Published 2022-01-19 Partial fix · 2.1.210 CWE-88
TI-2021-18806 CVE-2021-42392 · GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

Priority HIGH 83

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83176 Published 2022-01-07 Partial fix · 2.0.206 CWE-502
TI-2018-10278 CVE-2018-14335 · GHSA-wm64-883p-84j3

An issue was discovered in H2 1.4.197.

Priority MEDIUM 62

An issue was discovered in H2 1.4.197.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.13224 Published 2018-07-24 Partial fix CWE-276
TI-2021-06145 CVE-2021-23463 · GHSA-7rpj-hg47-cx62

XML external entity (XXE) injection in com.h2database:h2

Priority MEDIUM 44

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcRe…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02787 Published 2021-12-10 Partial fix · 2.0.202 CWE-611
Open these records in search →