H2o

H2o

27 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2024-5550

Exploit
  • EPSS 0.84%
  • Veröffentlicht 06.06.2024 19:16:09
  • Zuletzt bearbeitet 15.10.2025 13:15:46

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. S...

7.1

CVE-2024-1456

Exploit
  • EPSS 0.24%
  • Veröffentlicht 16.04.2024 00:15:08
  • Zuletzt bearbeitet 28.07.2025 14:04:52

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.

8.2

CVE-2023-6569

Exploit
  • EPSS 0.72%
  • Veröffentlicht 14.12.2023 13:15:55
  • Zuletzt bearbeitet 21.11.2024 08:44:07

External Control of File Name or Path in h2oai/h2o-3

7.5

CVE-2023-6038

Exploit
  • EPSS 4.34%
  • Veröffentlicht 16.11.2023 17:15:09
  • Zuletzt bearbeitet 21.11.2024 08:43:01

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default insta...

7.1

CVE-2023-6017

Exploit
  • EPSS 0.86%
  • Veröffentlicht 16.11.2023 17:15:08
  • Zuletzt bearbeitet 21.11.2024 08:42:59

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.

5.4

CVE-2023-6013

Exploit
  • EPSS 0.75%
  • Veröffentlicht 16.11.2023 17:15:08
  • Zuletzt bearbeitet 21.11.2024 08:42:58

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.

9.8

CVE-2023-6016

Exploit
  • EPSS 30.57%
  • Veröffentlicht 16.11.2023 16:15:34
  • Zuletzt bearbeitet 21.11.2024 08:42:59

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.