H2database

H2

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.8

CVE-2022-45868

Exploit
  • EPSS 0.1%
  • Veröffentlicht 23.11.2022 21:15:11
  • Zuletzt bearbeitet 21.11.2024 07:29:52

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an a...

10

CVE-2022-23221

Exploit
  • EPSS 22.2%
  • Veröffentlicht 19.01.2022 17:15:09
  • Zuletzt bearbeitet 05.05.2025 17:17:56

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

10

CVE-2021-42392

Exploit
  • EPSS 91.12%
  • Veröffentlicht 10.01.2022 14:10:23
  • Zuletzt bearbeitet 21.11.2024 06:27:43

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execut...

9.1

CVE-2021-23463

Exploit
  • EPSS 0.38%
  • Veröffentlicht 10.12.2021 20:15:07
  • Zuletzt bearbeitet 21.11.2024 05:51:47

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If...

6.5

CVE-2018-14335

Exploit
  • EPSS 8.6%
  • Veröffentlicht 24.07.2018 13:29:00
  • Zuletzt bearbeitet 21.11.2024 03:48:50

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.

8.8

CVE-2018-10054

  • EPSS 54.41%
  • Veröffentlicht 11.04.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:40:43

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."