CVE-2012-2196

IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the 1 GETWRAPCFGC or 2 GETWRAPCFGC2 stored procedure...

CVE-2012-2197

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges...

Stack overflow

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges...

CVE-2012-2197

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges...

Directory traversal

Directory traversal vulnerability in the SQLJ.DB2INSTALLJAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors...

Code injection

IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the 1 GETWRAPCFGC or 2 GETWRAPCFGC2 stored procedure...

CVE-2012-2194

Directory traversal vulnerability in the SQLJ.DB2INSTALLJAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors...

CVE-2012-2196

IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the 1 GETWRAPCFGC or 2 GETWRAPCFGC2 stored procedure...

CVE-2012-2197

CVE-2012-2197 affects IBM DB2 Java Stored Procedure infrastructure across multiple DB2 releases (9.1 before FP12, 9.5–FP9, 9.7–FP6, 9.8–FP5, 10.1). The vulnerability is a stack-based buffer overflow that could allow remote authenticated execution of arbitrary code by exploiting CONNECT and EXECUT...

CVE-2012-2197

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges...

CVE-2012-2196

IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the 1 GETWRAPCFGC or 2 GETWRAPCFGC2 stored procedure...

CVE-2012-2196

CVE-2012-2196 affects IBM DB2 LUW 9.1 (before FP12), 9.5 (through FP9), 9.7 (through FP6), 9.8 (through FP5), and 10.1 (through FP1). Affected routines GET_WRAP_CFG_C and GET_WRAP_CFG_C2 allow an authenticated user, without proper authority, to read XML files accessible to the DB2 fenced ID. Impa...

CVE-2012-2194

CVE-2012-2194 : IBM DB2 stores vulnerability in the SQLJ.DB2_INSTALL_JAR stored procedure on Windows. Affected: DB2 9.1 (pre FP12), 9.5 (pre FP9), 9.7 (pre FP6), 9.8 (pre FP5), 10.1. Description: directory traversal allows a remote attacker with valid DB2 credentials to overwrite JAR files by cal...

CVE-2012-2194

Directory traversal vulnerability in the SQLJ.DB2INSTALLJAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors...

IBM DB2 9.1 < Fix Pack 12 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.1 running on the remote host is affected by one or more of the following issues : - An integer signedness error exists in the 'db2asrrm' process that can lead to a heap-based buffer overflow. Note that this issue does not affect Windows host...

Authentication Capture: DRDA (DB2, Informix, Derby)

This module provides a fake DRDA DB2, Informix, Derby server that is designed to capture authentication credentials. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

IBM DB2 9.7 < Fix Pack 6 Multiple Vulnerabilities

According to its version, the installation of DB2 9.7 running on the remote host is prior to Fix Pack 6. It is, therefore, affected by multiple vulnerabilities : - A local user can exploit a vulnerability in the bundled IBM Tivoli Monitoring Agent ITMA to escalate their privileges. CVE-2011-4061 ...

IBM DB2 9.8 < Fix Pack 5 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.8 running on the remote host is prior to Fix Pack 5. It is, therefore, affected by multiple vulnerabilities : - An authorized user with 'CONNECT' privileges from 'PUBLIC' can cause a denial of service via unspecified methods related to DB2's...

IBM DB2 9.1 < Fix Pack 11 Multiple DoS

According to its version, the installation of IBM DB2 9.1 running on the remote host is prior to Fix Pack 11. It is, therefore, affected by multiple denial of service vulnerabilities : - The version of Java that is bundled with the application can enter an infinite loop when handling certain...

CVE-2012-2180

The chaining functionality in the Distributed Relational Database Architecture DRDA module in IBM DB2 9.7 before FP6 and 9.8 before FP5 allows remote attackers to cause a denial of service NULL pointer dereference, and resource consumption or daemon crash via a crafted request...