CyberSecBulletin

H2database vulnerabilities

We track 2 vulnerabilities in H2database products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 23, 2022.

2vulnerabilities
1critical
1high
0exploited
8.8average CVSS score

Latest H2database vulnerabilities

  • 7.8 High severity

    H2: Cleartext Storage of Sensitive Information

    CVE-2022-45868H2database

    The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker th

  • 9.8 Critical severity

    H2: Improper Neutralization of Argument Delimiters in a Command

    CVE-2022-23221H2databaseEPSS 64.8%

    H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.