CVE-2021-36758

The CVE concerns 1Password Connect server prior to 1.2, where insufficient validation during Secrets Automation token creation allows privilege escalation by tokens that exceed a user’s access, limited only by the existing authorizations of the Secret Automation where created. Affected component:...

PT-2021-21341

Name of the Vulnerable Software and Affected Versions 1Password Connect server version 1.2 and earlier Description The issue is related to missing validation checks in the 1Password Connect server, allowing users to create Secrets Automation access tokens for privilege escalation. Malicious users...

Security Bulletin: IBM® Db2® could allow an authenticated user to overwrite arbitrary files due to improper group permissions. (CVE-2020-4945)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an authenticated user to overwrite arbirary files due to improper group permissions. Vulnerability Details CVEID: CVE-2020-4945 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could...

CVE-2020-4885

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

Input validation

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945...

CVE-2020-4945

CVE-2020-4945 affects IBM Db2 LUW (11.5, includes Db2 Connect Server) and IBM Cloud Pak System Software, where an authenticated user could overwrite arbitrary files due to improper group permissions. The root cause is file-permission misconfigurations that grant the attacker enough access to repl...

CVE-2021-20579: Undefined Security Weakness

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. IBM X-Force ID: 199283...

PT-2021-3399

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server version 11.5 Description The issue is caused by a race condition of a symbolic link, allowing a local user to access and change the configuration of Db2. It is also described as...

CVE-2021-29777: Inclusion of Functionality from Untrusted Control Sphere

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031...

PT-2021-14053

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description: The issue allows a user who can create a view or inline SQL function to obtain sensitive information when AUTO REVAL is set ...

PT-2021-18473

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 9.7, 10.1, 10.5, 11.1, and 11.5 Description The issue allows an authenticated user to cause a denial of service under specific circumstances, such as when a table is bein...

PT-2021-18419

Name of the Vulnerable Software and Affected Versions Db2 for Linux, UNIX and Windows includes Db2 Connect Server affected versions not specified Description The issue is related to a denial of service, where the server terminates abnormally when executing a specially crafted SELECT statement...

CVE-2021-29703: Undefined Security Weakness

Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659...

PT-2021-3398

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server version 11.5 Description The issue is related to improper group permissions, allowing an authenticated user to overwrite arbitrary files. This could potentially be exploited by a...

CVE-2020-4885: Improper Link Resolution Before File Access

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

CVE-2021-29703

Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659...

IBM DB2 安全漏洞

IBM DB2 is a set of relational database management system from IBM in the United States. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2 for Linux, UNIX, and Windows including DB2 Connect Server that allows an...

IBM DB2 命令注入漏洞

IBM DB2 is a relational database management system from the American company IBM. The system's execution environments are mainly UNIX, Linux, IBMi, z/OS, and Windows server versions. A security vulnerability exists in IBM Db2 for Linux, UNIX, and Windows including Db2 Connect Server, which stems...

PT-2021-18418

Name of the Vulnerable Software and Affected Versions Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1.4 and 11.5.5 Description The issue allows for a denial of service, causing the server to terminate abnormally when it executes a specially crafted SELECT statement...

CVE-2021-29702: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658...