Security Bulletin: IBM® Db2® is vulnerable to a denial of service under certain conditions (CVE-2025-3050).

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources. Vulnerability Details CVEID:CVE-2025-3050 DESCRIPTION: IBM Db2 for Linux, UNIX and Windo...

CVE-2025-36117 IBM Db2 Mirror for i session fixation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36117

CVE-2025-36117 affects IBM Db2 Mirror for i 7.4–7.6. The vulnerability arises because the system does not discard the session id after use, enabling an authenticated user to impersonate another user on the system. Impact is described as session fixation with potential for credential/identity misu...

CVE-2025-36117 IBM Db2 Mirror for i session fixation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36116

Summary: CVE-2025-36116 affects IBM Db2 Mirror for i GUI versions 7.4, 7.5, and 7.6. The vulnerability is a cross-site WebSocket hijacking flaw that could allow an unauthenticated attacker to sniff an existing WebSocket connection and remotely perform operations the user is not allowed to perform...

CVE-2025-36116 IBM Db2 Mirror for i cross-site websocket hijacking

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that th...

CVE-2025-36116 IBM Db2 Mirror for i cross-site websocket hijacking

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that th...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (May 2025)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities [CVE-2025-36116, CVE-2025-36117].

Summary IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in the remediation/fixes section...

PT-2025-30587 · Ibm · Ibm I Db2 Mirror For I

Name of the Vulnerable Software and Affected Versions: IBM Db2 Mirror for i versions 7.4 through 7.6 Description: The IBM Db2 Mirror for i GUI is susceptible to a cross-site WebSocket hijacking issue. An unauthenticated malicious actor can exploit this by sending a specially crafted request to...

PT-2025-30588 · Ibm · Ibm I Db2 Mirror For I

Name of the Vulnerable Software and Affected Versions: IBM Db2 Mirror for i versions 7.4 through 7.6 Description: IBM Db2 Mirror for i does not disallow the session id after use, potentially allowing an authenticated user to impersonate another user on the system. Recommendations: IBM Db2 Mirror...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to tampering and elevation of privilege (CVE-2025-30065) due to the use of IBM Db2

Summary IBM Virtualization Engine TS7700 is susceptible to a tampering and privilege escalation vulnerability CVE-2025-30065, due to the use of IBM Db2, which is primarily embedded to store metadata related to the data it manages. Additionally, this patch also includes updates for other...

Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.

Summary IBM Application Performance Management is vulnerable to denial of service, remote code execution, information disclosures and other vulnerabilities due to bundled product IBM ® Db2. This bulletin identifies the steps to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-300...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2025 - Includes Oracle April 2024 CPU plus CVE-2025-4447

Summary Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2025 - Includes Oracle April 2024 CPU plus CVE-2025-4447 Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An unspecified vulnerability in Java SE related to the Server: DDL component...

IBM DB2 DoS (7235072/7235073) (Windows)

According to it self-reported version number, IBM Db2 is affected by multiple vulnerabilities. - A denial of service as the server may crash under certain conditions with a specially crafted query. CVE-2025-2518 - An authenticated user to cause a denial of service when using Q replication due to...

IBM DB2 DoS (7235072/7235073) (Unix)

According to it self-reported version number, IBM Db2 is affected by multiple vulnerabilities. - A denial of service as the server may crash under certain conditions with a specially crafted query. CVE-2025-2518 - An authenticated user to cause a denial of service when using Q replication due to...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects IBM® Db2®. (April 2025 CPU)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7.1.5.25 and earlier, 8.0.8.40 and earlier used by IBM® Db2. These issues were disclosed as part of the IBM Java SDK updates in April 2025. Vulnerability Details CVEID:CVE-2025-4447 DESCRIPTION: In Eclipse OpenJ9 versions ...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console (CVE-2023-39325, CVE-2022-21698)

Summary github.com/prometheus/clientgolang, golang.org/x/net are dependency packages used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2023-39325 DESCRIPTION: A malicious HTTP/2 client which rapid...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console (CVE-2022-23648, CVE-2022-32149)

Summary The listed dependency packages are being used by IBM Db2 Data Management Console github.com/containerd/containerd, golang.org/x/text. This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2022-27664 DESCRIPTION: In net/http in Go befo...

Security Bulletin: Vulnerability in github.com/jackc/pgx/v4 affects IBM Db2 Data Management Console(CVE-2024-27289)

Summary github.com/jackc/pgx/v4 dependency package is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2024-27289 DESCRIPTION: pgx is a PostgreSQL driver and toolkit for Go. Prior to version...