Description of the security update for SharePoint Server Subscription Edition: October 14, 2025 (KB5002786)

None None...

EUVD-2020-0461

Malware in sbrugna...

EUVD-2018-6257

Malware in sbrugna...

EUVD-2021-2477

Malware in sbrugna...

EUVD-2020-0044

Malware in sbrugna...

CVE-2025-58583 User Enumeration

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

EUVD-2025-29450

Malicious code in bioql PyPI...

EUVD-2021-31077

Malicious code in bioql PyPI...

EUVD-2022-54255

Malicious code in bioql PyPI...

EUVD-2025-9649

Malicious code in bioql PyPI...

EUVD-2022-7189

Malicious code in bioql PyPI...

EUVD-2022-41827

Malicious code in bioql PyPI...

EUVD-2023-41366

Malicious code in bioql PyPI...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ImportSQLTable process of the H2 JDBC Driver when handling the connectionurl argument. An attacker can execute arbitrary code by supplying crafted serialized data remotely. Details Serialization...

CVE-2025-10769

A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connectionurl leads to deserialization. The attack may be launched remotely. The exploit has been disclos...

SUSE SLES15 Security Update : python-h2 (SUSE-SU-2025:03273-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03273-1 advisory. - CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers bsc1248737 Tenable has extracted the preceding...

SUSE-SU-2025:03273-1 Security update for python-h2

This update for python-h2 fixes the following issues: - CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers bsc1248737...

HTTP Request Smuggling (HRS)

mitmproxy is vulnerable to HTTP request smuggling. The vulnerability is due to mitmproxy embedding python-hyper/h2 ≤ v4.2.0 which has a gap in its HTTP/2 header validation, which allows an attacker to smuggle requests when mitmproxy translates HTTP/2 to HTTP/1...

CVE-2025-58748 Dataease H2 data source JDBC URL validation bypass leads to remote code execution

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation H2.java does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon...

CVE-2025-58748

CVE-2025-58748 affects DataEase up to version 2.10.12, where the H2 data source (H2.java) does not validate that a JDBC URL starts with jdbc:h2 . This enables a crafted configuration to substitute the Amazon Redshift driver and leverage socketFactory/socketFactoryArg to trigger a remote XML resou...