Overview 23 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
23matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC8.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
23
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
8.7%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
21
91.3%
split by
peak 4 / year
20011
Not applicable1
Low1
not blocked1
Working exploit published1
20020
20030
20040
20053
Not applicable3
Low3
not blocked3
Working exploit published1
No public exploit2
20060
20072
Not applicable2
Low2
not blocked2
No public exploit2
20080
20091
Not applicable1
Low1
not blocked1
No public exploit1
20104
Not applicable4
Low4
not blocked4
No public exploit4
20111
Not applicable1
Low1
not blocked1
No public exploit1
20121
Not applicable1
Low1
not blocked1
No public exploit1
20132
Not applicable2
Low2
not blocked2
No public exploit2
20143
Not applicable3
Low3
not blocked3
No public exploit3
20151
Not applicable1
Low1
not blocked1
No public exploit1
20160
20172
Not applicable2
Low2
not blocked2
No public exploit2
20180
20190
20200
20210
20220
20230
20240
20250
20262
Not applicable2
Low2
not blocked2
No public exploit2
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-18104 | Low | 2026-09-24 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption. |
| CVE-2026-18096 | Low | 2026-08-12 | Not applicable | No public exploit | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak. |
| CVE-2017-1520 | Low | 2017-09-12 | Not applicable | No public exploit | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830. |
| CVE-2017-1150 | Low | 2017-03-08 | Not applicable | No public exploit | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515. |
| CVE-2015-1922 | Low | 2015-07-20 | Not applicable | No public exploit | The Data Movement implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to bypass intended access restrictions and delete table rows via unspecified vectors. |
| CVE-2014-6159 | Low | 2014-11-08 | Not applicable | No public exploit | IBM DB2 9.7 before FP10, 9.8 through FP5, 10.1 through FT4, and 10.5 through FP4 on Linux, UNIX, and Windows, when immediate AUTO_REVAL is enabled, allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement. |
| CVE-2014-4805 | Low | 2014-09-04 | Not applicable | No public exploit | IBM DB2 10.5 before FP4 on Linux and AIX creates temporary files during CDE table LOAD operations, which allows local users to obtain sensitive information by reading a file while a LOAD is occurring. |
| CVE-2014-3095 | Low | 2014-09-04 | Not applicable | No public exploit | The SQL engine in IBM DB2 9.5 through FP10, 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted UNION clause in a subquery of a SELECT statement. |
| CVE-2013-4025 | Low | 2013-09-25 | Not applicable | No public exploit | IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x do not have an off autocomplete attribute for the login-password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. |
| CVE-2013-4022 | Low | 2013-09-25 | Not applicable | No public exploit | IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x store unspecified authentication information in a cookie, which allows remote authenticated users to bypass intended access restrictions via unknown vectors. |
| CVE-2012-0713 | Low | 2012-08-24 | Not applicable | No public exploit | Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors. |
| CVE-2011-1373 | Low | 2011-11-09 | Not applicable | No public exploit | Unspecified vulnerability in IBM DB2 9.7 before FP5 on UNIX, when the Self Tuning Memory Manager (STMM) feature and the AUTOMATIC DATABASE_MEMORY setting are configured, allows local users to cause a denial of service (daemon crash) via unknown vectors. |
| CVE-2010-3737 | Low | 2010-10-05 | Not applicable | No public exploit | Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (heap memory consumption) by executing a (1) user-defined function (UDF) or (2) stored procedure while using a different code page than the database server. |
| CVE-2010-3735 | Low | 2010-10-05 | Not applicable | No public exploit | The "Query Compiler, Rewrite, Optimizer" component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted query involving certain UNION ALL views, leading to an indefinitely large amount of compilation time. |
| CVE-2010-3732 | Low | 2010-10-05 | Not applicable | No public exploit | The DRDA Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (database server ABEND) by using the client CLI on Linux, UNIX, or Windows for executing a prepared statement with a large number of parameter markers. |
| CVE-2010-3196 | Low | 2010-08-31 | Not applicable | No public exploit | IBM DB2 9.7 before FP2, when AUTO_REVAL is IMMEDIATE, allows remote authenticated users to cause a denial of service (loss of privileges) to a view owner by defining a dependent view. |
| CVE-2009-1905 | Low | 2009-06-03 | Not applicable | No public exploit | The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors. |
| CVE-2007-4272 | Low | 2007-08-18 | Not applicable | No public exploit | Multiple vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to create arbitrary files via (1) unspecified vectors where an attacker's umask is honored, (2) /etc/ld.so.preload, (3) certain "cron data file locations", and other unspecified vectors possibly involving the (4) OSSEMEMDBG or (5) TRC_LOG_FILE environment variable in db2licd (db2licm). |
| CVE-2007-4271 | Low | 2007-08-18 | Not applicable | No public exploit | Directory traversal vulnerability in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary files via a .. (dot dot) in an unspecified environment variable, which is appended to "/tmp/" and used as a log file. NOTE: this issue might be related to symlink following. |
| CVE-2005-4869 | Low | 2005-12-31 | Not applicable | Working exploit published | The (1) to_char and (2) to_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty string in the second parameter, which causes a null pointer dereference. |
| CVE-2005-3568 | Low | 2005-11-16 | Not applicable | No public exploit | db2fmp process in IBM DB2 Content Manager before 8.2 Fix Pack 10 allows local users to cause a denial of service (CPU consumption) by importing a corrupted Microsoft Excel file, aka "CORRUPTED EXEL FILE WILL CAUSE TEXT SEARCH PROCESS LOOPING." |
| CVE-2005-2073 | Low | 2005-06-29 | Not applicable | No public exploit | Unknown vulnerability in IBM DB2 8.1.4 through 8.1.9 and 8.2.0 through 8.2.2 allows local users with SELECT privileges to conduct unauthorized activities and insert, update or delete table contents. |
| CVE-2001-0052 | Low | 2001-02-16 | Not applicable | Working exploit published | IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query. |