Search CVE reports
1 – 5 of 5 results
CVE-2022-45868
Low priority** DISPUTED ** The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console....
3 affected packages
h2database, jameica-h2database, mediathekview
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| h2database | Not affected | Not affected | Not affected | Not affected | Not affected |
| jameica-h2database | Not affected | Not in release | Not in release | Not in release | Ignored |
| mediathekview | Not affected | Not affected | Not affected | Not affected | Not affected |
CVE-2022-23221
Medium prioritySome fixes available 5 of 8
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than...
1 affected package
h2database
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| h2database | Not affected | Fixed | Fixed | Fixed | Fixed |
CVE-2021-42392
High prioritySome fixes available 5 of 8
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers,...
1 affected package
h2database
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| h2database | Not affected | Fixed | Fixed | Fixed | Fixed |
CVE-2021-23463
Medium priorityThe package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from...
1 affected package
h2database
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| h2database | Not affected | Not affected | Not affected | Not affected | Not affected |
CVE-2018-14335
Medium priorityAn issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
1 affected package
h2database
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| h2database | Not affected | Not affected | Vulnerable | Vulnerable | Vulnerable |