Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: h2database Component: H2 Clear all filters
TI-2022-07362 CVE-2022-23221 · GHSA-45hx-wfhj-473x

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a…

Priority CRITICAL 85

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64766 Published 2022-01-19 Partial fix · 2.1.210 CWE-88
TI-2021-18806 CVE-2021-42392 · GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

Priority HIGH 83

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83176 Published 2022-01-07 Partial fix · 2.0.206 CWE-502
TI-2021-06145 CVE-2021-23463 · GHSA-7rpj-hg47-cx62

XML external entity (XXE) injection in com.h2database:h2

Priority MEDIUM 44

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcRe…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02787 Published 2021-12-10 Partial fix · 2.0.202 CWE-611
TI-2018-10278 CVE-2018-14335 · GHSA-wm64-883p-84j3

An issue was discovered in H2 1.4.197.

Priority MEDIUM 62

An issue was discovered in H2 1.4.197.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.13224 Published 2018-07-24 Partial fix CWE-276