H2database H2
6 CVEs affecting H2database H2. Latest disclosed: 2022-11-23. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23221 | Critical | 9.8 | 2022-01-19 | H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREAT… |
CVE-2021-42392 | Critical | 9.8 | 2022-01-10 | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pas… |
CVE-2018-10054 | High | 8.8 | 2018-04-11 | H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the… |
CVE-2022-45868 | High | 8.4 | 2022-11-23 | The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to speci… |
CVE-2021-23463 | High | 8.1 | 2021-12-10 | The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object… |
CVE-2018-14335 | Medium | 6.5 | 2018-07-24 | An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permi… |