Juggle

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials (sa/juggle) are known. An unauthenticated remote attacker can reach the console and, using the default credentials, achieve OS command execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.