H2database

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 6
    Known Exploited: 0
    2
    Critical Level Threats
    3
    High Level Threats
    1
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2022-45868

    The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that." Nonetheless, the issue was fixed in 2.2.220.

    Last Modified: Nov 21, 2024
    Published: Nov 23, 2022

    CVE-2022-23221

    h2: Loading of custom classes from remote servers through JNDI

    Last Modified: May 05, 2025
    Published: Jan 19, 2022

    CVE-2021-42392

    h2: Remote Code Execution in Console

    Last Modified: Nov 21, 2024
    Published: Jan 04, 2022

    CVE-2021-23463

    XML External Entity (XXE) Injection

    Last Modified: Nov 21, 2024
    Published: Oct 22, 2021

    CVE-2018-14335

    h2: Information Exposure due to insecure handling of permissions in the backup

    Last Modified: Nov 21, 2024
    Published: Jul 23, 2018
    Items Per Page