Skip to content
OpenAdvisories

Package · Debian

h2database

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.4
    CVE-2022-45868

    Password exposure in H2 Database

    The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker t…

    com.h2database:h2 h2database Debian Maven
  • Critical 9.8
    CVE-2022-23221 Public exploit EPSS 65%

    Arbitrary code execution in H2 Console

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

    com.h2database:h2 h2database h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2021-42392 Public exploit EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven