Threat Advisories:

Critical Cloud Threat: Azure Blob Storage Under Active Attack Operation Silk Lure Scam: When Job Hunts Leads to Malware Storm-1175’s Masterstroke Exploits CVE-2025-10035 in GoAnywhere MFT F5 BIG-IP Breach: Nation-State Hackers Expose Source Code and Undisclosed Flaws Microsoft’s October 2025 Patch Tuesday TA585 Leverages ClickFix Technique and MonsterV2 Malware Astaroth Targets Brazil Using GitHub Infrastructure CVE-2025-11371: Unpatched Gladinet Flaw Actively Exploited in the Wild Stealit’s New Trick: Packing Malware Inside Node.js Single Executables Hidden in Plain Sight: The Abuse of Nezha and the Ghost RAT That Followed UTA0388: AI-Powered Targeted Operations Leveraging GOVERSHELL Zimbra Zero-Day Hidden in “Harmless” ICS File Targets Military Service Finder Plugin Flaw Opens Door to Full Site Compromise Redis Under Siege: RediShell Flaw Opens Door to Remote Code Execution CVE-2025-61882: Oracle EBS Zero-Day Actively Exploited in the Wild Water Saci: Brazil’s WhatsApp-Borne Malware Storm Confucius Hackers Spy on Critical Sectors Using AnonDoor FunkLocker: Emerging AI-Assisted Ransomware Olymp Loader: Modular Malware Built for Rapid Exploitation VMware Aria and Tools Vulnerabilities Fixed Amid Ongoing Exploitation

Highlights of Our CISO Dinner

Upgrading struggling vulnerability management programs to Threat Exposure Management, with Host, CISO Al Lindseth formerly from Plains All American Pipeline and PWC - 6 minute podcast

0:00

Play Count: Loading...

Partner Program

Book a Demo Threat Digest - Subscribe

A similar vulnerability like Log4shell discovered in H2 database console

Threat Level – Red | Vulnerability Report

Download PDF

For a detailed advisory, download the pdf file here.

An unauthenticated remote code execution vulnerability similar to Log4shell has been discovered in H2 Database (a popular Java SQL database) console and has been assigned CVE-2021-42392. It is claimed to be similar to the log4shell vulnerability since they both share the same root cause i.e they both are based on the Java Naming and Directory Interface (JNDI).

This flaw allows attacker-controlled URLs to be passed unfiltered to the javax.naming.Context.lookup function via numerous code paths in the H2 database system and execute remote code. The H2 database has an embedded web-based console for the database management which runs by default at https://localhost:8082. This console allows an unauthenticated attacker to run remote code execution as it fails to validate the parameters such as ‘User Name’ and ‘Password’ before performing lookup with the malicious URL in ‘JDBC URL’ field.

Organizations using an H2 console which is exposed to LAN or WAN should update H2 database to version 2.0.206 immediately.

Upgrading to version 2.0.206 eliminates this vulnerability. However, organization who cannot upgrade to version 2.0.206 can use either of the mitigations below:

The newer version of Java contains trustURLCodebase that does not allow remote codebases to load via JNDI, so upgrading to the latest version of Java (JRE/JDK) will eliminate this vulnerability. However, this mitigation can be bypassed sending a serialized “gadget” Java object through LDAP. When the H2 console Servlet is installed on a web server, a security constraint can be introduced to restrict access to the console page to specified users.

Vulnerabiliy Details

Patch Links

https://github.com/h2database/h2database/releases/tag/version-2.0.206

https://www.h2database.com/html/main.html

References

https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/

https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6

https://github.com/cybersecurityworks553/CVE-2021-42392-Detect

https://exchange.xforce.ibmcloud.com/vulnerabilities/216834

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox