CVE-2018-14335

概要

参考情報

• access.redhat.com/errata/RHSA-2020:0727
• gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20 · Exploit
• lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
• security.netapp.com/advisory/ntap-20240726-0003
• exploit-db.com/exploits/45105 · Exploit

h2 のその他の脆弱性

• CVE-2022-45868高 7.8The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allow…
• CVE-2022-23221緊急 9.8H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTING…
• CVE-2021-42392緊急 9.8The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. …
• CVE-2021-23463緊急 9.1The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.Jdbc…
• CVE-2018-10054高 8.8H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary J…