Browse CVEs

HIGH 8.2 CVE-2024-8616 In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability aris… H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.5 CVE-2024-8062 A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to ver… H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.5 CVE-2024-7768 A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a … H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.5 CVE-2024-7765 In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The s… H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.1 CVE-2024-6854 In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any… H2o No fix yet Fix from $1,9502025-03-20 MEDIUM 6.5 CVE-2024-6863 In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key o… H2o No fix yet Fix from $1,6002025-03-20 HIGH 7.5 CVE-2024-10549 A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-spec… H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.5 CVE-2024-10550 A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a u… H2o No fix yet Fix from $1,9502025-03-20 HIGH 7.5 CVE-2024-10572 In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGB… H2o No fix yet Fix from $1,9502025-03-20 CRITICAL 9.8 CVE-2024-8862 A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the f… H2o No fix yet Fix from $2,3002024-09-14 MEDIUM 5.3 CVE-2024-5550 In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulne… H2o No fix yet Fix from $1,6002024-06-06 HIGH 7.1 CVE-2024-1456 An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-train… H2o No fix yet Fix from $1,9502024-04-16 HIGH 8.2 CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3 H2o No fix yet Fix from $1,9502023-12-14 HIGH 7.5 CVE-2023-6038 A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the ser… H2o No fix yet Fix from $1,9502023-11-16 HIGH 7.1 CVE-2023-6017 H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. H2o No fix yet Fix from $1,9502023-11-16 MEDIUM 5.4 CVE-2023-6013 H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack. H2o No fix yet Fix from $1,6002023-11-16 CRITICAL 9.8 CVE-2023-6016EPSS 31% An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. H2o No fix yet Fix from $2,3002023-11-16