Login Request a demo
H2
Product
H2
by H2database · last CVE Nov 23, 2022
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 3High 2Medium 1Low 0
Severity
All severities6Critical3High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add H2 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-23221
9.8
65%
Jan 19
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the…
Affected: 1.1.100 before 2.0.206
CVE-2021-42392
9.8
83%
Jan 10
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database
Affected: 1.1.000 through 2.0.204
CVE-2021-23463
9.1
3%
Dec 10
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives…
Affected: 1.4.198 before 2.0.202
CVE-2018-10054
8.8
34%
Apr 11
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code
Affected: 1.4.197
CVE-2022-45868
7.8
0%
Nov 23
The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in…
Affected: through 2.1.214
CVE-2018-14335
6.5
13%
Jul 24
An issue was discovered in H2 1.4.197
Affected: 1.4.197
Showing 6