H2 vulnerabilities

2 known vulnerabilities in H2 from H2database. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  H2: Cleartext Storage of Sensitive Information

  CVE-2022-45868Nov 23, 2022H2database

  The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker th

• 9.8 Critical severity

  H2: Improper Neutralization of Argument Delimiters in a Command

  CVE-2022-23221Jan 19, 2022H2databaseEPSS 64.8%

  H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.