CVE-2023-34468

CVE-2023-34468: Apache NiFi の DB コンポーネントを介したリモートコード実行 Apache NiFi 0.0.2 から 1.21.0 の DBCPConnectionPool および HikariCPConnectionPool コントローラサービスでは、認証済みかつ承認済みのユーザーが、任意のコード実行を可能にする H2 ドライバーを使用したデータベース URL を設定できます。 ベンダー開示: この脆弱性に関するベンダーの開示と修正はこちらで確認できます。 前提条件: この脆弱性には以下が必要です: 有効なユーザー認証情報 概念実証:...

CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator...

PT-2026-1866

Name of the Vulnerable Software and Affected Versions JimuReport versions through 2.1.3 Description The software is susceptible to remote code execution when handling user-supplied H2 JDBC URLs. The application directly passes the attacker-controlled JDBC URL to the H2 driver, enabling the use of...

CVE-2025-10769

A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connectionurl leads to deserialization. The attack may be launched remotely. The exploit has been disclos...

Apache NiFi 代码注入漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A code injection vulnerability exists in Apache NiFi versions 0.0.2 through 1.21.0 that originates from allowing...