CVE-2023-29257

IBM Db2 code execution

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-29256

IBM Db2 information disclosure

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-29255

IBM DB2 for Linux, UNIX and Windows denial of service

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-27869

IBM Db2 code execution

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517.

CVSS 3.1 · 6.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-27868

IBM Db2 code execution

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516.

CVSS 3.1 · 6.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-27867

IBM Db2 code execution

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249514.

CVSS 3.1 · 6.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2023-27558

IBM Db2 privilege escalation

IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Db2 Db2 Windows Windows

CVE-2023-27555

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers. IBM X-Force ID: 249187.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-26022

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-26021

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-23487

IBM Db2 audit logging

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft and 1 more

Products

Aix Db2 Linux Kernel and 2 more

CVE-2022-43928

IBM Db2 Mirror for i information disclosure

The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory. IBM X-Force ID: 241675.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2024-40679

IBM Db2 information disclosure

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2023-38729

IBM Db2 information disclosure

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 5 more

CVE-2023-30443

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hp Ibm Linux and 2 more

Products

Hp-ux Aix Db2 and 3 more

CVE-2024-41762

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2024-41761

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux

Products

Db2 Linux On Ibm Z Linux Kernel

CVE-2023-25930

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-27559

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2023-47741

IBM i information disclosure

IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim's PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I I