Overview 219 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 0 EPSS ≥ 0.5
219matches
1in Waratek scope0.5%
1protected0.5%
0exploited0.0%
0CISA KEV0.0%
8public PoC3.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
0.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
5
2.3%
Not applicable
213
97.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.5%
partly blocked
0
0.0%
not blocked
218
99.5%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
3.7%
Proof of concept only
5
2.3%
Forecast only
0
0.0%
No public exploit
206
94.1%
split by
peak 36 / year
20011
Not applicable1
High1
not blocked1
Working exploit published1
20020
20034
Not applicable4
High4
not blocked4
Working exploit published2
No public exploit2
20045
Not applicable5
High5
not blocked5
Working exploit published2
No public exploit3
20058
Not applicable8
High8
not blocked8
Working exploit published1
No public exploit7
20060
200716
Not applicable16
High16
not blocked16
No public exploit16
200813
Not applicable13
High13
not blocked13
No public exploit13
200910
Not applicable10
High10
not blocked10
No public exploit10
20105
Not applicable5
High5
not blocked5
No public exploit5
20112
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20126
Not applicable6
High6
not blocked6
No public exploit6
20131
Not applicable1
High1
not blocked1
No public exploit1
20143
Not applicable3
High3
not blocked3
No public exploit3
20151
Not applicable1
High1
not blocked1
No public exploit1
20161
Not applicable1
High1
not blocked1
No public exploit1
20174
Not applicable4
High4
not blocked4
Working exploit published1
No public exploit3
201817
Not applicable17
High17
not blocked17
No public exploit17
201915
Not applicable15
High15
not blocked15
No public exploit15
20206
Outside Waratek scope1
Not applicable5
High6
not blocked6
No public exploit6
202110
Outside Waratek scope4
Not applicable6
High10
not blocked10
No public exploit10
20224
Not applicable4
High4
not blocked4
No public exploit4
202336
Not applicable36
High36
not blocked36
No public exploit36
20246
Not applicable6
High6
not blocked6
No public exploit6
202519
Not applicable19
High19
not blocked19
Proof of concept only5
No public exploit14
202626
Protected by Waratek1
Not applicable25
High26
blocked by ARMR today1
not blocked25
No public exploit26
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-87958 | High | 2026-09-10 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions. |
| CVE-2026-86093 | High | 2026-09-10 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking. |
| CVE-2026-18554 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-18178 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
| CVE-2026-17179 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection. |
| CVE-2026-17177 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
| CVE-2026-17175 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. |
| CVE-2026-17081 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-16915 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. |
| CVE-2026-16879 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input. |
| CVE-2026-16708 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration. |
| CVE-2026-16480 | High | 2026-08-12 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. |
| CVE-2026-10535 | High | 2026-07-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc. |
| CVE-2026-9762 | High | 2026-07-17 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. |
| CVE-2025-27511 | High | 2026-06-18 | Protected by Waratek | No public exploit | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue. |
| CVE-2026-6938 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query. |
| CVE-2026-6052 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables. |
| CVE-2026-6051 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap. |
| CVE-2026-1718 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled. |
| CVE-2025-36247 | High | 2026-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. |
| CVE-2025-13108 | High | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources. |
| CVE-2025-36442 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns. |
| CVE-2025-36384 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element. |
| CVE-2025-36365 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. |
| CVE-2025-36184 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. |
| CVE-2025-36070 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. |
| CVE-2025-36186 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. |
| CVE-2025-33012 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date. |
| CVE-2025-2534 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-47118 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2025-36071 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources. |
| CVE-2025-36010 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock. |
| CVE-2025-33114 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to denial of service with a specially crafted query under certain non-default conditions. |
| CVE-2025-33092 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a stack-based buffer overflow in db2fm, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. |
| CVE-2025-2533 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-51473 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-49828 | High | 2025-07-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2025-48498 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for coordination. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-46354 | High | 2025-07-22 | Not applicable | Proof of concept only | A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted network packet can lead to a denial of service. An attacker can send a malicious packet to trigger this vulnerability. |
| CVE-2025-36520 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the net_connectmsg Protocol Buffer Message functionality of Bloomberg Comdb2 8.1. A specially crafted network packets can lead to a denial of service. An attacker can send packets to trigger this vulnerability. |
| CVE-2025-36512 | High | 2025-07-22 | Not applicable | Proof of concept only | A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-35966 | High | 2025-07-22 | Not applicable | Proof of concept only | A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. |
| CVE-2025-2518 | High | 2025-05-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-49350 | High | 2025-05-29 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-52903 | High | 2025-05-01 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-45663 | High | 2024-11-21 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. |
| CVE-2024-33687 | High | 2024-06-24 | Not applicable | No public exploit | Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration. |
| CVE-2023-42005 | High | 2024-05-29 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264. |
| CVE-2023-47152 | High | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. |
| CVE-2023-45193 | High | 2024-01-22 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 268759. |
| CVE-2023-47145 | High | 2024-01-07 | Not applicable | No public exploit | IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality. IBM X-Force ID: 270402. |
| CVE-2023-47701 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 266166. |
| CVE-2023-46167 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 269367. |
| CVE-2023-40692 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-Force ID: 264807. |
| CVE-2023-40687 | High | 2023-12-04 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB table. IBM X-Force ID: 264809. |
| CVE-2023-38727 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statement. IBM X-Force ID: 262257. |
| CVE-2023-38003 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that they should not have access to. IBM X-Force ID: 260214. |
| CVE-2023-29258 | High | 2023-12-04 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated query on specific federation objects. IBM X-Force ID: 252048. |
| CVE-2023-45178 | High | 2023-12-03 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM X-Force ID: 268073. |
| CVE-2023-40373 | High | 2023-10-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574. |
| CVE-2023-40372 | High | 2023-10-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499. |
| CVE-2023-40374 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575. |
| CVE-2023-38740 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-Force ID: 262613. |
| CVE-2023-38728 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258. |
| CVE-2023-38720 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616. |
| CVE-2023-30991 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037. |
| CVE-2023-30987 | High | 2023-10-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases. IBM X-Force ID: 253440. |
| CVE-2023-30449 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 253439. |
| CVE-2023-30448 | High | 2023-07-10 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437. |
| CVE-2023-30447 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436. |
| CVE-2023-30446 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253361 . |
| CVE-2023-30445 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253357. |
| CVE-2023-30442 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202. |
| CVE-2023-30431 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code. IBM X-Force ID: 252184. |
| CVE-2023-27869 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517. |
| CVE-2023-27868 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516. |
| CVE-2023-27867 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249514. |
| CVE-2023-27558 | High | 2023-07-10 | Not applicable | No public exploit | IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194. |
| CVE-2023-27555 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187. |
| CVE-2023-26022 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868. |
| CVE-2023-26021 | High | 2023-04-28 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864. |
| CVE-2023-29255 | High | 2023-04-27 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991. |
| CVE-2023-29257 | High | 2023-04-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011. |
| CVE-2023-27559 | High | 2023-04-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196. |
| CVE-2022-43930 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IBM X-Force ID: 241677. |
| CVE-2022-43929 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID: 241676. |
| CVE-2022-43927 | High | 2023-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671. |
| CVE-2022-41296 | High | 2022-12-12 | Not applicable | No public exploit | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210. |
| CVE-2022-33971 | High | 2022-07-04 | Not applicable | No public exploit | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program. |
| CVE-2022-33208 | High | 2022-07-04 | Not applicable | No public exploit | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller. |
| CVE-2022-22390 | High | 2022-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973. |
| CVE-2021-39002 | High | 2021-12-09 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
| CVE-2021-29678 | High | 2021-12-09 | Outside Waratek scope | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modify files. IBM X-Force ID: 199914. |
| CVE-2021-20373 | High | 2021-12-09 | Not applicable | No public exploit | IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521. |
| CVE-2021-29825 | High | 2021-09-16 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470. |
| CVE-2021-29703 | High | 2021-06-24 | Not applicable | No public exploit | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659. |
| CVE-2020-4945 | High | 2021-06-24 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945. |
| CVE-2021-29702 | High | 2021-06-16 | Not applicable | No public exploit | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658. |
| CVE-2019-4588 | High | 2021-05-26 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. |
| CVE-2020-5025 | High | 2021-03-11 | Outside Waratek scope | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 193661. |