Cross site scripting

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...

CVE-2023-6016

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

Design/Logic Flaw

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

CVE-2023-6013

CVE-2023-6013 affects H2O with a stored XSS vulnerability that can lead to a Local File Include attack. Affected component is H2O’s web layer handling inputs, with the underlying issue described as stored XSS in multiple feeds and pages. Impact stated in sources includes potential exposure of loc...

CVE-2023-6013 H2O Local File Include

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...

CVE-2023-6013 H2O Local File Include

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...

CVE-2023-6017 H2O S3 Bucket Takeover

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-6017

CVE-2023-6017 concerns H2O with a reference to an S3 bucket that no longer exists, which could allow an attacker to take over the S3 bucket URL. The connected sources (NVD/Red Hat/PRION-like records) confirm the same vulnerability description across multiple feeds, indicating an issue where an ou...

CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038

CVE-2023-6038 describes a Local File Inclusion in the h2o-3 REST API (ImportFiles and ParseSetup endpoints). An unauthenticated attacker can read arbitrary files on the server with the h2o-3 process’s user permissions. Affected version identified in sources is 3.40.0.4. The issue is severity high...

CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6016 H2O Remote Code Execution via POJO Model Import

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

CVE-2023-6016

CVE-2023-6016 affects H2O Dashboard via POJO model import, enabling remote code execution on a server hosting the dashboard. The vulnerability is described as a high-severity, network-exploitable issue with no user interaction required, per the NVD metrics (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I...

PT-2023-32489 · H2O-3 · H2O-3

Name of the Vulnerable Software and Affected Versions: h2o-3 version 3.40.0.4 Description: A Local File Inclusion LFI issue exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. Th...

PT-2023-32479 · H2O · H2O

Name of the Vulnerable Software and Affected Versions: H2O affected versions not specified Description: The issue allows an attacker to gain remote code execution on a server hosting the H2O dashboard. This is achieved through the POJO model import feature. Recommendations: At the moment, there i...

H2O Security Breach

H2O is an in-memory platform for distributed, scalable machine learning. H2O suffers from a security vulnerability that stems from allowing an unauthenticated attacker to read any file on the server where the H2O dashboard resides...

S3 Bucket can lead to spread of malicious R package

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack...

FreeBSD : h2o -- uninitialised memory access in HTTP3 (1d3677a8-9143-42d8-84a3-0585644dff4b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1d3677a8-9143-42d8-84a3-0585644dff4b advisory. - h2o is an open source http server. In code prior to the 8c0eca3 commit h2o may attempt to access...

CVE-2023-39283

An SMM memory corruption vulnerability in the SMM driver SMRAM write in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation...