H2Oai vulnerabilities, page 2
30 vulnerabilities
Known vulnerabilities in H2Oai products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
PrioritiseCVE-2024-7765h2oai · h2oai/h2o-3 +3 moreDenial of Service in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.CVSS7.5HighEPSS0.78%RoutineCVE-2024-8862h2oai · h2o-3 +2 moreh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationA vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS1.33%PrioritiseCVE-2024-5979h2oai · h2oai/h2o-3 +2 moreDenial of Service via Invalid Argument in h2oai/h2o-3In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.CVSS7.5HighEPSS0.79%RoutineCVE-2024-5550h2oai · h2oai/h2o-3 +2 moreExposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.CVSS5.3MediumEPSS0.83%PrioritiseCVE-2024-1456h2oai · h2oai/h2o-3 +1 moreS3 Bucket Takeover in h2oai/h2o-3An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.CVSS7.1HighEPSS0.24%PrioritiseCVE-2023-6569h2oai · h2oai/h2o-3 +2 moreExternal Control of File Name or Path in h2oai/h2o-3CVSS9.3CriticalEPSS0.72%PrioritiseCVE-2023-6013h2oai · h2oai/h2o-3 +1 moreH2O Local File IncludeH2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.CVSS9.3CriticalEPSS0.75%PrioritiseCVE-2023-6017h2oai · h2oai/h2o-3 +1 moreH2O S3 Bucket TakeoverH2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.CVSS8.7HighEPSS0.85%PrioritiseCVE-2023-6038h2oai · h2oai/h2o-3 +2 moreLocal File Inclusion in h2oai/h2o-3A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.CVSS9.3CriticalEPSS4.34%PrioritiseCVE-2023-6016h2oai · h2oai/h2o-3 +1 moreH2O Remote Code Execution via POJO Model ImportAn attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.CVSS10.0CriticalEPSS30.57%