h2database h2 1.4.197 vulnerabilities and exploits

(subscribe to this query)

H2 Console prior to 2.1.210 allows remote malicious users to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

H2database H2 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Oracle Communications Cloud Native Core Console 1.9.0

5 Github repositories

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited thr...

H2database H2 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Oracle Communications Cloud Native Core Policy 1.15.0

8 Github repositories

H2 1.4.197, as used in Datomic prior to 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."

H2database H2 1.4.197 Cognitect Datomic

2 Github repositories

An issue exists in H2 1.4.197. Insecure handling of permissions in the backup function allows malicious users to read sensitive files (outside of their permissions) via a symlink to a fake database file.

H2database H2 1.4.197

1 EDB exploit1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook