ai.h2o:h2o-app (>=3.22.0.1, <=3.28.0.3), ai.h2o:h2o-automl (>=3.22.0.1, <=3.28.0.3) +16 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.10.5.1, <=3.46.0.11)

ai.h2o:h2o-ext-xgboost MAVEN version =3.10.5.1, =3.22.0.1, =3.22.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.6.12, =2.0.10, =3.30.0.5-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.6.12, =2.0.10, =3.30.0.5-1-3.0, =1.6.12, =2.0.10, =3.30.0.5-1-3.0, =3.46.0.6-1-3.5 and more Source cves: CVE-2024-10572...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the runtool command which exposes classes in the water.tools package via the ast parser. An attacker can shut down the server and write large files to arbitrary directories by exploiting the...