CVE-2012-1797

CVE-2012-1797 affects IBM DB2 9.5 where the file nodes.reg is created with world-writable permissions. The OpenVAS entry notes a permission weakness in IBM DB2 that is addressed by a vendor fix (Fix Pack 9). No explicit exploitation details or impact are provided beyond the permission issue; CVSS...

CVE-2012-0712

CVE-2012-0712 affects IBM DB2 XML Feature in DB2 9.5 (before FP9), 9.7 (through FP5), and 9.8 (through FP4). The flaw allows a remote authenticated user to cause a denial of service (infinite loop) by invoking XMLPARSE with a crafted string expression. IBM’s bulletin notes the vulnerability requi...

CVE-2012-0711

CVE-2012-0711 is a remote code execution/privilege-escalation vulnerability in the DB2 Administration Server (DAS) of IBM DB2. The issue is a heap-based buffer overflow caused by an integer signedness error in the db2dasrrm process and affects UNIX platforms on: DB2 9.1 GA through FP11, DB2 9.5 G...

CVE-2012-1797

IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors...

CVE-2012-0710

IBM DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 allows remote attackers to cause a denial of service daemon crash via a crafted Distributed Relational Database Architecture DRDA request...

CVE-2012-1796

CVE-2012-1796 affects IBM DB2 9.5 environments using the Tivoli Monitoring Agent (ITMA). The connected records indicate a Linux/UNIX local privilege escalation via ITMA within DB2 9.5 before FP9. The NVD entry describes an unspecified local vulnerability in ITMA that enables privilege gains with ...

CVE-2012-0709

IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements...

CVE-2012-0712

The XML feature in IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 allows remote authenticated users to cause a denial of service infinite loop by calling the XMLPARSE function with a crafted string expression...

CVE-2012-0711

Integer signedness error in the db2dasrrm process in the DB2 Administration Server DAS in IBM DB2 9.1 through FP11, 9.5 before FP9, and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow...

CVE-2012-0710

IBM DB2 DRDA vulnerability CVE-2012-0710 enables remote attackers to crash the database server via a crafted DRDA request. Affected releases include DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 across multiple platforms. IBM’s Security Bulletin and related records confi...

IBM DB2 9.5 < 9.5 Fix Pack 9 Multiple Vulnerabilities

Binary data 6347.prm...

DB2 9.5 < Fix Pack 9 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.5 running on the remote host is prior to Fix Pack 9. It is, therefore, affected by the following vulnerabilities : - Incorrect, world-writable file permissions are in place for the file 'NODES.REG'. IC79518 - An unspecified error can allow...

Database Open Access Information Disclosure Vulnerability

Various Database server might be prone to an information disclosure vulnerability if accessible to remote systems. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

[SECURITY] Fedora 16 Update: WebCalendar-1.2.4-3.fc16

WebCalendar is a PHP-based calendar application that can be configured as a single-user calendar, a multi-user calendar for groups of users, or as an event calendar viewable by visitors. MySQL, PostgreSQL, Oracle, DB2, Interbase, MS SQL Server, or ODBC is required. WebCalendar can be setup in a...

DB2 Authentication Brute Force Utility

This module attempts to authenticate against a DB2 instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework requi...

IBM DB2 / DB2 Connect Tivoli监视代理DT_RPATH特权提升漏洞

Bugtraq ID: 51181 CVE ID：CVE-2011-4061 IBM DB2 Universal Database Server是一款大型的商业关系数据库系统 IBM DB2/IBM DB2 Connect存在安全漏洞，允许恶意本地用户提升特权 Tivoli监视代理ITMA绑定的SUID "tmaitm6/lx8266/bin/kbbacf1"可执行文件不安全使用DTRPATH来装载libkbb.so库，本地攻击者可以利用此漏洞诱使目标用户在特制库所在目录运行应用程序，可装载任意库提升权限 0 DB2 Connect 9.x IBM DB2 9.x 厂商解决方案...

IBM DB2 9.7 < Fix Pack 5 Multiple Denial of Service Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 5. It is, therefore, affected by multiple denial of service vulnerabilities : - On Unix and Unix-like systems with both the Self Tuning Memory Manager STMM feature enabled and the...

IBM DB2 9.7 < 9.7 Fix Pack 5 Local DoS

Binary data 6099.prm...

CVE-2011-4435

The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...

Directory traversal

The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...