Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.h2database:h2

4 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 2 high
Registry
Maven Central

Advisories 4

  • The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which…

    Affected: from 1.4.198, fixed in 2.2.220.

  • CVE-2022-23221Critical 9.8

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the…

    Affected: fixed in 2.1.210.

  • The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

    Affected: from 1.1.100, fixed in 2.0.206.

  • XML External Entity (XXE) Injection

    Affected: from 1.4.198, fixed in 2.0.202.