715 matches found
ai.h2o:h2o-admissibleml (>=3.34.0.1 <=3.40.0.4), ai.h2o:h2o-algos (>=0.1.9 <=3.40.0.4) +44 more potentially affected by CVE-2023-6038 via ai.h2o:h2o-core (>=0.1.9 <=3.40.0.4)
ai.h2o:h2o-core MAVEN version =0.1.9, =3.34.0.1, =0.1.9, =0.1.9, =3.12.0.1, =3.10.0.1, =3.14.0.7, =3.16.0.1, =3.14.0.1, =3.24.0.1, =3.30.1.1, =3.26.0.4, =3.10.5.1, =3.24.0.1, =3.30.0.1, =3.34.0.3, =3.40.0.4 and more Source cves: CVE-2023-6038 Source advisory: OSV:GHSA-6MV8-95X5-XCQ9...
H2O local file inclusion vulnerability
A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...
GHSA-6MV8-95X5-XCQ9 H2O local file inclusion vulnerability
A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...
CVE-2023-6038
A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...
CVE-2023-6017
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...
CVE-2023-6013
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...
CVE-2023-6013
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...
CVE-2023-6017
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...
Cross site scripting
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...
CVE-2023-6016
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...
Design/Logic Flaw
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...
CVE-2023-6013 H2O Local File Include
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...
CVE-2023-6013
CVE-2023-6013 affects H2O with a stored XSS vulnerability that can lead to a Local File Include attack. Affected component is H2O’s web layer handling inputs, with the underlying issue described as stored XSS in multiple feeds and pages. Impact stated in sources includes potential exposure of loc...
CVE-2023-6013 H2O Local File Include
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...
CVE-2023-6017 H2O S3 Bucket Takeover
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...
CVE-2023-6017
CVE-2023-6017 concerns H2O with a reference to an S3 bucket that no longer exists, which could allow an attacker to take over the S3 bucket URL. The connected sources (NVD/Red Hat/PRION-like records) confirm the same vulnerability description across multiple feeds, indicating an issue where an ou...
CVE-2023-6038 Local File Inclusion in h2oai/h2o-3
A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...
CVE-2023-6038 Local File Inclusion in h2oai/h2o-3
A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...
CVE-2023-6038
CVE-2023-6038 describes a Local File Inclusion in the h2o-3 REST API (ImportFiles and ParseSetup endpoints). An unauthenticated attacker can read arbitrary files on the server with the h2o-3 process’s user permissions. Affected version identified in sources is 3.40.0.4. The issue is severity high...