Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
167 results · page 2 of 4
Apr 15, 2025An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7.CVE-2024-49200 · Other software · Insyde · reported by MITREMedium 6.4
An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code execution. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44; kernel 5.5, Version 05.54.44; kernel 5.6, Version 05.61.44; and kernel 5.7, Version 05.70.44.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server.CVE-2024-8616 · Other software · h2oai · reported by security@huntr.devHigh 8.2
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service.CVE-2024-8062 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service.CVE-2024-7768 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service.CVE-2024-7765 · Other software · h2oai · reported by security@huntr.devHigh 7.5
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choCVE-2024-6863 · Other software · h2oai · reported by security@huntr.devMedium 6.5
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in thCVE-2024-6854 · Other software · h2oai · reported by security@huntr.devHigh 7.1
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser.CVE-2024-10572 · Other software · h2oai · reported by security@huntr.devHigh 7.5
In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrustedCVE-2024-10553 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.CVE-2024-10550 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.CVE-2024-10549 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.CVE-2024-45403 · Other software · h2o · reported by GitHubLow 3.7
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Picotls is a TLS protocol library that allows users select different crypto backends based on their use case.CVE-2024-45402 · Other software · h2o · reported by GitHubHigh 8.6
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d.
- Product
- picotls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.CVE-2024-45397 · Other software · h2o · reported by GitHubMedium 5.9
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Quicly is an IETF QUIC protocol implementation.CVE-2024-45396 · Other software · h2o · reported by GitHubHigh 7.5
Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc41460262e64ffcad5c.
- Product
- quicly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.CVE-2024-25622 · Other software · h2o · reported by GitHubLow 3.1
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2024A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4.CVE-2024-8862 · Other software · h2oai · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrumbling-slice-eb0.notion.sitevuldb.com
Sep 6, 2024H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution.CVE-2024-45758 · Other software · h2oai · reported by MITRECritical 9.1
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
- Product
- h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comspear-shield.notion.site
Jul 31, 2024An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before CVE-2023-28149 · Other software · reported by MITREMedium 6.1
An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before 05.53.39, and 5.6 before 05.60.39 that could allow an attacker to modify UEFI variables.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster.CVE-2024-6960 · Other software · mvnrepository · reported by reefs@jfrog.comHigh 7.5
The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform.
- Product
- h2o-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
Jun 27, 2024In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be CVE-2024-5979 · Other software · h2oai · reported by security@huntr.devHigh 7.5
In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature.CVE-2024-5550 · Other software · h2oai · reported by security@huntr.devMedium 5.3
In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.CVE-2024-27353 · Other software · insyde · reported by MITREHigh 7.4
A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.
- Product
- insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel CVE-2024-25079 · Other software · insyde · reported by MITREHigh 7.4
A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.
- Product
- insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07CVE-2024-25078 · Other software · insyde · reported by MITREHigh 7.4
A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM.
- Product
- insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6.CVE-2023-47252 · Other software · Insyde · reported by MITREMedium 6.3
An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, leading to tampering. The PNP-related SMI sub-functions do not verify data size before getting it from the communication buffer, which could lead to possible circumstances where the data immediately following the command buffer could be destroyed with a fixed value. This is fixed in kernel 5.2 v05.28.45, kernel 5.3 v05.37.45, kernel 5.4 v05.45.45, kernel 5.5 v05.53.45, and kernel 5.6 v05.60.45.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2024An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2022-46897 · Other software · insyde · reported by MITREMedium 5.3
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a method or function. This can prevent it from detecting unexpected states and conditions.
- Product
- insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository.CVE-2024-1456 · Other software · h2oai · reported by security@huntr.devHigh 7.1
An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 0CVE-2022-24351 · Other software · Insyde · reported by MITREMedium 4.7
TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 05.44.13, and Kernel 5.5 before version 05.52.13 allows an attacker to alter data and code used by the remainder of the boot process.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023External Control of File Name or Path in h2oai/h2o-3CVE-2023-6569 · Other software · h2oai · reported by security@huntr.devHigh 8.2
External Control of File Name or Path in h2oai/h2o-3
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.CVE-2023-50247 · Other software · h2o · reported by GitHubLow 3.7
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressively increase the memory retained by the QUIC stack. This can eventually cause H2O to abort due to memory exhaustion. The vulnerability has been resolved in commit d67e81d03be12a9d53dc8271af6530f40164cd35. HTTP/1 and HTTP/2 are not affected by this vulnerability as they do not use QUIC. Administrators looking to mitigate this issue without upgrading can disable HTTP/3 support.
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.CVE-2023-41337 · Other software · h2o · reported by GitHubMedium 6.1
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportunity to observe or inject packets exchanged between the client and h2o may misdirect HTTPS requests going to other backends and observe the contents of that HTTPS request being sent. The attack involves a victim client trying to resume a TLS connection and an attacker redirecting the packets to a different address or port than that intended by the client. The attacker must already have been configured by the administrator of h2o to act as a backend to one of the addresses or ports that the h2o instance listens to. Session IDs and tickets generated by h2o are not bound to information specific to the server address, port, or the X.509 certificate, and therefore it is possible for an attacker to force the victim connection to wrongfully resume against a different server address or port on which the same h2o instance is listening. Once a TLS session is misdirected to resume to a server addre
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53CVE-2023-40238 · Other software · Fujitsu · reported by MITREMedium 5.5
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.
- Product
- Esprimo D556/2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinarly.iosecurity.netapp.com
Nov 16, 2023A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with thCVE-2023-6038 · Other software · h2oai · reported by security@huntr.devHigh 7.5
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.CVE-2023-6017 · Other software · h2oai · reported by security@huntr.devHigh 7.1
H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.CVE-2023-6013 · Other software · h2oai · reported by security@huntr.devMedium 5.4
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.CVE-2023-6016 · Other software · h2oai · reported by security@huntr.devCritical 9.8
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to seCVE-2023-39283 · Other software · insyde · reported by MITREHigh 7.8
An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.
- Product
- insydeh20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-39284 · Other software · Insyde · reported by MITREMedium 5.5
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execCVE-2023-39281 · Other software · insyde · reported by MITRECritical 9.8
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.
- Product
- insydeh20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-30633 · Other software · Insyde · reported by MITREMedium 5.3
An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. (For example, Windows uses these PCR measurements to determine device health.) A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Register (PCR) banks. This requires physical access to a target victim's device, or compromise of user credentials for a device. This issue is similar to CVE-2021-42299 (on Surface Pro devices).
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-34195 · Other software · Insyde · reported by MITREHigh 7.8
An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00.CVE-2021-33834 · Other software · Insyde · reported by MITREHigh 7.1
An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash.
- Product
- H2offt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-27471 · Other software · Insyde · reported by MITREMedium 5.5
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerability could potentially lead to denial of service for the platform.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-31041 · Other software · Insyde · reported by MITREHigh 7.5
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-27373 · Other software · Insyde · reported by MITREMedium 5.5
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5.CVE-2023-28468 · Other software · Insyde · reported by MITREMedium 6.5
An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
- Product
- Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An issue was discovered in InsydeH2O.CVE-2023-25600 · Other software · Insyde · reported by MITREHigh 7.1
An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016.
- Product
- Insydecrpkg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023H2O is an HTTP server.CVE-2023-30847 · Other software · h2o · reported by GitHubHigh 8.2
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.
- Product
- h2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5.CVE-2023-22616 · Other software · Insyde · reported by MITREHigh 7.8
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.cominsyde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.