Overview 502 matches · 2 in Waratek scope · 2 protected · 1 exploited · 0 CISA KEV · 13 public PoC · 0 EPSS ≥ 0.5
502matches
2in Waratek scope0.4%
2protected0.4%
1exploited0.2%
0CISA KEV0.0%
13public PoC2.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
0.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
8
1.6%
Not applicable
492
98.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.4%
partly blocked
0
0.0%
not blocked
500
99.6%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 96 / year
20013
Not applicable3
High1
Medium1
Low1
not blocked3
Working exploit published2
No public exploit1
20020
20036
Not applicable6
High4
Medium2
not blocked6
Working exploit published3
No public exploit3
20046
Not applicable6
High5
Medium1
not blocked6
Working exploit published2
No public exploit4
200519
Not applicable19
High8
Medium8
Low3
not blocked19
Working exploit published2
No public exploit17
20065
Not applicable5
Medium5
not blocked5
No public exploit5
200729
Not applicable29
High16
Medium11
Low2
not blocked29
No public exploit29
200825
Not applicable25
High13
Medium12
not blocked25
No public exploit25
200932
Not applicable32
High10
Medium21
Low1
not blocked32
Working exploit published1
No public exploit31
201021
Not applicable21
High5
Medium12
Low4
not blocked21
Working exploit published1
No public exploit20
20118
Not applicable8
High2
Medium5
Low1
not blocked8
Working exploit published1
No public exploit7
201213
Not applicable13
High6
Medium6
Low1
not blocked13
No public exploit13
20138
Not applicable8
High1
Medium5
Low2
not blocked8
No public exploit8
201410
Not applicable10
High3
Medium4
Low3
not blocked10
No public exploit10
20156
Not applicable6
High1
Medium4
Low1
not blocked6
No public exploit6
20162
Not applicable2
High1
Medium1
not blocked2
No public exploit2
201710
Not applicable10
High4
Medium4
Low2
not blocked10
Working exploit published1
No public exploit9
201830
Not applicable30
Critical1
High17
Medium12
not blocked30
No public exploit30
201919
Not applicable19
High15
Medium4
not blocked19
No public exploit19
202014
Outside Waratek scope1
Not applicable13
High6
Medium8
not blocked14
No public exploit14
202118
Outside Waratek scope7
Not applicable11
High10
Medium8
not blocked18
No public exploit18
20229
Not applicable9
Critical1
High4
Medium4
not blocked9
Exploited1
No public exploit8
202344
Not applicable44
Critical1
High36
Medium7
not blocked44
No public exploit44
202430
Not applicable30
High6
Medium24
not blocked30
No public exploit30
202539
Protected by Waratek1
Not applicable38
High19
Medium20
blocked by ARMR today1
not blocked38
Proof of concept only5
No public exploit34
202696
Protected by Waratek1
Not applicable95
Critical10
High26
Medium58
Low2
blocked by ARMR today1
not blocked95
No public exploit96
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-26021 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864. |
| CVE-2023-25930 | Medium | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862. |
| CVE-2023-29255 | High | 2023-04-27 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991. |
| CVE-2023-29257 | High | 2023-04-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011. |
| CVE-2023-27559 | High | 2023-04-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196. |
| CVE-2022-43928 | Medium | 2023-04-07 | Not applicable | No public exploit | The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory. IBM X-Force ID: 241675. |
| CVE-2022-43930 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IBM X-Force ID: 241677. |
| CVE-2022-43929 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID: 241676. |
| CVE-2022-43927 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671. |
| CVE-2022-41296 | High | 2022-12-12 | Not applicable | No public exploit | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210. |
| CVE-2022-41297 | Medium | 2022-12-01 | Not applicable | No public exploit | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212. |
| CVE-2022-35637 | Medium | 2022-09-13 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823. |
| CVE-2022-22483 | Medium | 2022-09-13 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM X-Force ID: 225979. |
| CVE-2022-34151 | Critical | 2022-07-04 | Not applicable | Exploited | Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller. |
| CVE-2022-33971 | High | 2022-07-04 | Not applicable | No public exploit | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program. |
| CVE-2022-33208 | High | 2022-07-04 | Not applicable | No public exploit | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller. |
| CVE-2022-22390 | High | 2022-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973. |
| CVE-2022-22389 | Medium | 2022-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing specially crafted SQL statements by an authenticated user. IBM X-Force ID: 2219740. |
| CVE-2021-39002 | High | 2021-12-09 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
| CVE-2021-38931 | Medium | 2021-12-09 | Outside Waratek scope | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not authorized to select from. IBM X-Force ID: 210418. |
| CVE-2021-38926 | Medium | 2021-12-09 | Outside Waratek scope | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 210321. |
| CVE-2021-29678 | High | 2021-12-09 | Outside Waratek scope | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modify files. IBM X-Force ID: 199914. |
| CVE-2021-20373 | High | 2021-12-09 | Not applicable | No public exploit | IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521. |
| CVE-2021-29825 | High | 2021-09-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470. |
| CVE-2021-29763 | Medium | 2021-09-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267. |
| CVE-2021-29752 | Medium | 2021-09-16 | Not applicable | No public exploit | IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specific conditions. IBM X-Fporce ID: 201780. |
| CVE-2021-29777 | Medium | 2021-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031. |
| CVE-2021-29703 | High | 2021-06-24 | Not applicable | No public exploit | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659. |
| CVE-2021-20579 | Medium | 2021-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283. |
| CVE-2020-4945 | High | 2021-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945. |
| CVE-2020-4885 | Medium | 2021-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909. |
| CVE-2021-29702 | High | 2021-06-16 | Not applicable | No public exploit | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658. |
| CVE-2019-4588 | High | 2021-05-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. |
| CVE-2020-5025 | High | 2021-03-11 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 193661. |
| CVE-2020-5024 | High | 2021-03-11 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the SSL handshake response. IBM X-Force ID: 193660. |
| CVE-2020-4976 | Medium | 2021-03-11 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due to weak file permissions. IBM X-Force ID: 192469. |
| CVE-2020-4642 | Medium | 2020-12-23 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a denial of service inside the "DB2 Management Service". |
| CVE-2020-4739 | High | 2020-11-20 | Not applicable | No public exploit | IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 188149. |
| CVE-2020-4701 | High | 2020-11-19 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. |
| CVE-2020-4420 | High | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the execution of a terminate command. IBM X-Force ID: 180076. |
| CVE-2020-4414 | Medium | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unauthorized actions on the system, caused by improper usage of shared memory. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service. IBM X-Force ID: 179989. |
| CVE-2020-4387 | Medium | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269. |
| CVE-2020-4386 | Medium | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268. |
| CVE-2020-4363 | High | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 178960. |
| CVE-2020-4355 | Medium | 2020-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper handling of Secure Sockets Layer (SSL) renegotiation requests. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to increase the resource usage on the system. IBM X-Force ID: 178507. |
| CVE-2020-4230 | Medium | 2020-02-19 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacker with special permissions executes specially crafted Db2 commands. IBM X-Force ID: 175212. |
| CVE-2020-4204 | High | 2020-02-19 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 174960. |
| CVE-2020-4200 | Medium | 2020-02-19 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands to cause a denial of service. IBM X-Force ID: 174914. |
| CVE-2020-4161 | Medium | 2020-02-19 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341. |
| CVE-2020-4135 | High | 2020-02-19 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage. |
| CVE-2019-4606 | High | 2019-12-12 | Not applicable | No public exploit | IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298. |
| CVE-2019-4523 | High | 2019-10-22 | Not applicable | No public exploit | IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 165481. |
| CVE-2019-4448 | High | 2019-08-26 | Not applicable | No public exploit | IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum and db2hpum_debug binaries are setuid root and have built-in options that allow an low privileged user the ability to load arbitrary db2 libraries from a privileged context. This results in arbitrary code being executed with root authority. IBM X-Force ID: 163489. |
| CVE-2019-4447 | High | 2019-08-26 | Not applicable | No public exploit | IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trusts the PATH environment variable. A low privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user controlled location. When a crash is induced the trojan gdb command is executed. IBM X-Force ID: 163488. |
| CVE-2019-4386 | Medium | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714. |
| CVE-2019-4322 | High | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 161202. |
| CVE-2019-4154 | High | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 158519. |
| CVE-2019-4102 | Medium | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092. |
| CVE-2019-4101 | Medium | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of service. Users that have both EXECUTE on PD_GET_DIAG_HIST and access to the diagnostic directory on the DB2 server can cause the instance to crash. IBM X-Force ID: 158091. |
| CVE-2019-4057 | Medium | 2019-07-01 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567. |
| CVE-2019-4014 | High | 2019-04-03 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 155892. |
| CVE-2018-1936 | High | 2019-04-03 | Not applicable | No public exploit | IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 153316. |
| CVE-2019-4094 | High | 2019-03-21 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to root by loading a malicious shared library. IBM X-Force ID: 158014. |
| CVE-2019-4016 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 155894. |
| CVE-2019-4015 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 155893. |
| CVE-2018-1980 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078. |
| CVE-2018-1978 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154069. |
| CVE-2018-1923 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152859. |
| CVE-2018-1922 | High | 2019-03-11 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152858. |
| CVE-2018-1977 | Medium | 2018-12-14 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032. |
| CVE-2018-1897 | High | 2018-11-30 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462. |
| CVE-2018-1857 | Medium | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to bypass FGAC control and gain access to data they shouldn't be able to see. IBM X-Force ID: 151155. |
| CVE-2018-1834 | High | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to escalate their privileges to root through a symbolic link attack. IBM X-Force ID: 150511. |
| CVE-2018-1802 | High | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640. |
| CVE-2018-1799 | Medium | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwrite files on the system which could cause damage to the database. IBM X-Force ID: 149429. |
| CVE-2018-1781 | High | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148804. |
| CVE-2018-1780 | High | 2018-11-09 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148803. |
| CVE-2018-1711 | High | 2018-09-21 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 146369. |
| CVE-2018-1710 | High | 2018-09-21 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364. |
| CVE-2018-1685 | Medium | 2018-09-21 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502. |
| CVE-2018-1566 | High | 2018-07-10 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023. |
| CVE-2018-1487 | High | 2018-07-10 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972. |
| CVE-2018-1458 | High | 2018-07-10 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209. |
| CVE-2018-1565 | High | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 143022. |
| CVE-2018-1544 | High | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 142648. |
| CVE-2018-1515 | High | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1, under specific or unusual conditions, could allow a local user to overflow a buffer which may result in a privilege escalation to the DB2 instance owner. IBM X-Force ID: 141624. |
| CVE-2018-1488 | High | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5 and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 140973. |
| CVE-2018-1459 | High | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to stack based buffer overflow, caused by improper bounds checking which could lead an attacker to execute arbitrary code. IBM X-Force ID: 140210. |
| CVE-2018-1452 | Medium | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140047. |
| CVE-2018-1451 | Medium | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140046. |
| CVE-2018-1450 | Medium | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140045. |
| CVE-2018-1449 | Medium | 2018-05-25 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140044. |
| CVE-2018-1448 | High | 2018-03-22 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140043. |
| CVE-2018-1428 | Medium | 2018-03-22 | Not applicable | No public exploit | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139073. |
| CVE-2018-1427 | Medium | 2018-03-22 | Not applicable | No public exploit | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072. |
| CVE-2018-1426 | Critical | 2018-03-22 | Not applicable | No public exploit | IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071. |
| CVE-2017-1677 | High | 2018-03-22 | Not applicable | No public exploit | IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which leads to object injection and potentially arbitrary code execution depending on the classpath. IBM X-Force ID: 133999. |
| CVE-2017-1571 | Medium | 2018-03-22 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853. |
| CVE-2016-0215 | Medium | 2018-01-16 | Not applicable | No public exploit | IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database. |
| CVE-2017-1520 | Low | 2017-09-12 | Not applicable | No public exploit | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830. |