Overview 502 matches · 2 in Waratek scope · 2 protected · 1 exploited · 0 CISA KEV · 13 public PoC · 0 EPSS ≥ 0.5
502matches
2in Waratek scope0.4%
2protected0.4%
1exploited0.2%
0CISA KEV0.0%
13public PoC2.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
0.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
8
1.6%
Not applicable
492
98.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.4%
partly blocked
0
0.0%
not blocked
500
99.6%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 96 / year
20013
Not applicable3
High1
Medium1
Low1
not blocked3
Working exploit published2
No public exploit1
20020
20036
Not applicable6
High4
Medium2
not blocked6
Working exploit published3
No public exploit3
20046
Not applicable6
High5
Medium1
not blocked6
Working exploit published2
No public exploit4
200519
Not applicable19
High8
Medium8
Low3
not blocked19
Working exploit published2
No public exploit17
20065
Not applicable5
Medium5
not blocked5
No public exploit5
200729
Not applicable29
High16
Medium11
Low2
not blocked29
No public exploit29
200825
Not applicable25
High13
Medium12
not blocked25
No public exploit25
200932
Not applicable32
High10
Medium21
Low1
not blocked32
Working exploit published1
No public exploit31
201021
Not applicable21
High5
Medium12
Low4
not blocked21
Working exploit published1
No public exploit20
20118
Not applicable8
High2
Medium5
Low1
not blocked8
Working exploit published1
No public exploit7
201213
Not applicable13
High6
Medium6
Low1
not blocked13
No public exploit13
20138
Not applicable8
High1
Medium5
Low2
not blocked8
No public exploit8
201410
Not applicable10
High3
Medium4
Low3
not blocked10
No public exploit10
20156
Not applicable6
High1
Medium4
Low1
not blocked6
No public exploit6
20162
Not applicable2
High1
Medium1
not blocked2
No public exploit2
201710
Not applicable10
High4
Medium4
Low2
not blocked10
Working exploit published1
No public exploit9
201830
Not applicable30
Critical1
High17
Medium12
not blocked30
No public exploit30
201919
Not applicable19
High15
Medium4
not blocked19
No public exploit19
202014
Outside Waratek scope1
Not applicable13
High6
Medium8
not blocked14
No public exploit14
202118
Outside Waratek scope7
Not applicable11
High10
Medium8
not blocked18
No public exploit18
20229
Not applicable9
Critical1
High4
Medium4
not blocked9
Exploited1
No public exploit8
202344
Not applicable44
Critical1
High36
Medium7
not blocked44
No public exploit44
202430
Not applicable30
High6
Medium24
not blocked30
No public exploit30
202539
Protected by Waratek1
Not applicable38
High19
Medium20
blocked by ARMR today1
not blocked38
Proof of concept only5
No public exploit34
202696
Protected by Waratek1
Not applicable95
Critical10
High26
Medium58
Low2
blocked by ARMR today1
not blocked95
No public exploit96
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-36131 | Medium | 2025-11-07 | Not applicable | No public exploit | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system. |
| CVE-2025-36008 | Medium | 2025-11-07 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources. |
| CVE-2025-36006 | Medium | 2025-11-07 | Not applicable | No public exploit | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use. |
| CVE-2025-33012 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date. |
| CVE-2025-2534 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-47118 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2025-33133 | Medium | 2025-10-28 | Not applicable | No public exploit | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due an out of bounds write. |
| CVE-2025-33132 | Medium | 2025-10-28 | Not applicable | No public exploit | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to. |
| CVE-2025-33131 | Medium | 2025-10-28 | Not applicable | No public exploit | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack. |
| CVE-2025-33126 | Medium | 2025-10-28 | Not applicable | No public exploit | IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size. |
| CVE-2025-62228 | Medium | 2025-10-09 | Protected by Waratek | No public exploit | Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue. |
| CVE-2025-36071 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources. |
| CVE-2025-36010 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock. |
| CVE-2025-33114 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to denial of service with a specially crafted query under certain non-default conditions. |
| CVE-2025-33092 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a stack-based buffer overflow in db2fm, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. |
| CVE-2025-2533 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-52894 | Medium | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-51473 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-49828 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2025-36117 | Medium | 2025-07-23 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system. |
| CVE-2025-36116 | Medium | 2025-07-23 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform. |
| CVE-2025-48498 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for coordination. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-46354 | High | 2025-07-22 | Not applicable | Proof of concept only | A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted network packet can lead to a denial of service. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2025-36520 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the net_connectmsg Protocol Buffer Message functionality of Bloomberg Comdb2 8.1. A specially crafted network packets can lead to a denial of service. An attacker can send packets to trigger this vulnerability. |
| CVE-2025-36512 | High | 2025-07-22 | Not applicable | Proof of concept only | A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-35966 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-3050 | Medium | 2025-05-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources. |
| CVE-2025-2518 | High | 2025-05-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-49350 | High | 2025-05-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2025-1992 | Medium | 2025-05-05 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user in federation environment, to cause a denial of service due to insufficient release of allocated memory after usage. |
| CVE-2025-1493 | Medium | 2025-05-05 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. |
| CVE-2025-1000 | Medium | 2025-05-05 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting. |
| CVE-2025-0915 | Medium | 2025-05-05 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 under specific configurations could allow an authenticated user to cause a denial of service due to insufficient release of allocated memory resources. |
| CVE-2024-52903 | High | 2025-05-01 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-40679 | Medium | 2025-01-08 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions. |
| CVE-2023-30443 | Medium | 2024-12-19 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. |
| CVE-2024-41762 | Medium | 2024-12-07 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-37071 | Medium | 2024-12-07 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. |
| CVE-2024-41761 | Medium | 2024-11-23 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-45663 | High | 2024-11-21 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-31880 | Medium | 2024-10-23 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. |
| CVE-2024-37529 | Medium | 2024-08-14 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID: 294295. |
| CVE-2024-35152 | Medium | 2024-08-14 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. IBM X-Force ID: 292639. |
| CVE-2024-35136 | Medium | 2024-08-14 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain non default conditions. IBM X-Force ID: 291307. |
| CVE-2024-31882 | Medium | 2024-08-14 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287614. |
| CVE-2024-33687 | High | 2024-06-24 | Not applicable | No public exploit | Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration. |
| CVE-2024-31881 | Medium | 2024-06-12 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. IBM X-Force ID: 287613. |
| CVE-2024-28762 | Medium | 2024-06-12 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 285246. |
| CVE-2023-29267 | Medium | 2024-06-12 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287612. |
| CVE-2023-42005 | High | 2024-05-29 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264. |
| CVE-2024-27254 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 283813. |
| CVE-2024-25046 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service by an authenticated user using a specially crafted query. IBM X-Force ID: 282953. |
| CVE-2024-25030 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281677. |
| CVE-2024-22360 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted query on certain columnar tables. IBM X-Force ID: 280905. |
| CVE-2023-52296 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built-in function concurrently. IBM X-Force ID: 278547. |
| CVE-2023-38729 | Medium | 2024-04-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT. |
| CVE-2023-50308 | Medium | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables. IBM X-Force ID: 273393. |
| CVE-2023-47747 | Medium | 2024-01-22 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272646. |
| CVE-2023-47746 | Medium | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272644. |
| CVE-2023-47158 | Medium | 2024-01-22 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270750. |
| CVE-2023-47152 | High | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. |
| CVE-2023-47141 | Medium | 2024-01-22 | Not applicable | No public exploit | IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 270264. |
| CVE-2023-45193 | High | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 268759. |
| CVE-2023-27859 | Medium | 2024-01-22 | Not applicable | No public exploit | IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database. IBM X-Force ID: 249205. |
| CVE-2023-47145 | High | 2024-01-07 | Not applicable | No public exploit | IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402. |
| CVE-2023-47741 | Medium | 2023-12-18 | Not applicable | No public exploit | IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532. |
| CVE-2023-47701 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 266166. |
| CVE-2023-46167 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 269367. |
| CVE-2023-40692 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-Force ID: 264807. |
| CVE-2023-40687 | High | 2023-12-04 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB table. IBM X-Force ID: 264809. |
| CVE-2023-38727 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statement. IBM X-Force ID: 262257. |
| CVE-2023-38003 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that they should not have access to. IBM X-Force ID: 260214. |
| CVE-2023-29258 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated query on specific federation objects. IBM X-Force ID: 252048. |
| CVE-2023-45178 | High | 2023-12-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM X-Force ID: 268073. |
| CVE-2023-40373 | High | 2023-10-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574. |
| CVE-2023-40372 | High | 2023-10-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499. |
| CVE-2023-38719 | Medium | 2023-10-17 | Not applicable | No public exploit | IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607. |
| CVE-2023-40374 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575. |
| CVE-2023-38740 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-Force ID: 262613. |
| CVE-2023-38728 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258. |
| CVE-2023-38720 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616. |
| CVE-2023-30991 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037. |
| CVE-2023-30987 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases. IBM X-Force ID: 253440. |
| CVE-2023-35012 | Medium | 2023-07-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763. |
| CVE-2023-30449 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439. |
| CVE-2023-30448 | High | 2023-07-10 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437. |
| CVE-2023-30447 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436. |
| CVE-2023-30446 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361 . |
| CVE-2023-30445 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357. |
| CVE-2023-30442 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202. |
| CVE-2023-30431 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code. IBM X-Force ID: 252184. |
| CVE-2023-29256 | Medium | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046. |
| CVE-2023-27869 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517. |
| CVE-2023-27868 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516. |
| CVE-2023-27867 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249514. |
| CVE-2023-27558 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194. |
| CVE-2023-23487 | Medium | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918. |
| CVE-2023-27396 | Critical | 2023-06-19 | Not applicable | No public exploit | FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later) |
| CVE-2023-27555 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187. |
| CVE-2023-26022 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868. |