H2o

h2o

Vendor: H2o • 27 CVEs

CVEs (27)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-5550 1H2o 1H2o Jun 17, 2026 Jun 6, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file s...Show more In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.Show less
CVE-2024-1456 1H2o 1H2o Jun 17, 2026 Apr 16, 2024 N/A· v4 7.1 HIGH· v3 N/A· v2 An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.
CVE-2023-6569 1H2o 1H2o Jun 17, 2026 Dec 14, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 External Control of File Name or Path in h2oai/h2o-3
CVE-2023-6038 1H2o 1H2o Jun 17, 2026 Nov 16, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This i...Show more A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.Show less
CVE-2023-6017 1H2o 1H2o Jun 17, 2026 Nov 16, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.
CVE-2023-6013 1H2o 1H2o Jun 17, 2026 Nov 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
CVE-2023-6016 1H2o 1H2o Jun 17, 2026 Nov 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.

Previous 12