Advisories · Technology
h2oai h2o-3.
Every CVE that names h2oai h2o-3 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control
- h2oai h2o-3
- Privilege escalation
- Broken access control
- CVSS 6.9 Medium
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
- h2oai h2o-3
- Insecure deserialization
- CWE-20
- CVSS 6.9 Medium
h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
- h2oai h2o-3
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
- h2oai h2o-3
- Insecure deserialization
- CWE-20
- CVSS 5.3 Medium
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
- h2oai h2o-3
- Insecure deserialization
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
Deserialization Vulnerability in h2oai/h2o-3
- h2oai/h2o-3
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Deserialization of Untrusted Data in h2oai/h2o-3
- h2oai/h2o-3
- Insecure deserialization
- CVSS 7.1 High
S3 Bucket Takeover in h2oai/h2o-3
- h2oai/h2o-3
- CWE-840
- CVSS 9.3 CriticalCritical · CVSS 9+
H2O Local File Include
- h2oai/h2o-3
- Cross-site scripting (XSS)
- CVSS 8.7 High
H2O S3 Bucket Takeover
- h2oai/h2o-3
- CWE-840
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
H2O Remote Code Execution via POJO Model Import
- h2oai/h2o-3
- Code injection