CVE-2017-1519

This CVE-2017-1519 affects IBM DB2 10.5 and 11.1 (including DB2 Connect Server). It is a denial-of-service vulnerability where a remote attacker can disrupt service given a specific configuration. IBM security bulletins specify remediations: apply DB2 fixes FP9 for V10.5 (10.5 FP9) and FP2 for V1...

CVE-2017-1434

CVE-2017-1434 (IBM DB2 LUW/DB2 Connect Server) allows a local user to view highly sensitive information in the error log under certain conditions. IBM notes exposure occurs when upgrading Db2 to v11.x fails, writing the connection string in clear to db2diag.log; affected versions include DB2 LUW ...

CVE-2017-1434

IBM DB2 for Linux, UNIX and Windows 11.1 includes DB2 Connect Server under unusual circumstances, could expose highly sensitive information in the error log to a local user...

CVE-2017-1520

IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830...

CVE-2017-1451

IBM DB2 LUW 9.7, 10.1, 10.5, and 11.1 (including DB2 Connect Server) are affected by CVE-2017-1451. A local user with DB2 instance owner privileges could obtain root access due to a privilege-escalation flaw. Affected IBM products include DB2 LUW on Linux/Unix/Windows; several IBM security bullet...

CVE-2017-1452

CVE-2017-1452 affects IBM DB2 LUW (Linux/UNIX/Windows) including DB2 Connect Server and allows a local user to escalate privileges and overwrite DB2 files. Affected: DB2 9.7, 10.1, 10.5, 11.1; Windows is noted as not vulnerable in one bulletin. Base score ~6.7 (CVSS v3.0) with local, high-impact ...

CVE-2017-1438

CVE-2017-1438 is an IBM DB2 LUW local privilege-escalation vulnerability. Reports indicate a local user with DB2 instance owner privileges could obtain root access on DB2 LUW servers (versions 9.7, 10.1, 10.5, 11.1; includes DB2 Connect Server). Public details describe the underlying issue as a p...

CVE-2017-1520

CVE-2017-1520 affects IBM Db2 9.7, 10.1, 10.5, and 11.1. A local/remote issue allows an unauthorized command to activate the database when authentication type is CLIENT. CVSS v3 base score is 3.7 (low); vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. IBM bulletins document multiple fix-pack remediat...

CVE-2017-1519

IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup with a particular configuration. IBM X-Force ID: 129829...

CVE-2017-1438

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128057...

Local elevation of privilege vulnerability in multiple IBM DB2 products (CNVD-2017-32877)

IBM DB2 and DB2 Connect Server for Linux, UNIX, and Windows are database products for Linux, UNIX, and Windows platforms from IBM Corporation, U.S.A. DB2 is a relational database management system for use in large application environments.DB2 Connect Server is a DB2 Connect Server is a mainframe...

SQLMap v1.1.8 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

Five Tips for Getting Started with Scuba Database Vulnerability Scanner

Scuba is a free tool that scans leading enterprise databases for security vulnerabilities and configuration flaws, including patch levels, that allows you to uncover potential database security risks. It includes more than 2,300 assessment tests for Oracle, Microsoft SQL Server, SAP Sybase, IBM D...

Hardcoded credentials

MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilize...

CVE-2017-11614

CVE-2017-11614 involves MEDHOST Connex hard-coded IBM i DB2 user credentials (HMSCXPDN). The vulnerability arises because the password is embedded in multiple locations in the Connex application and cannot be changed by customers, and the account has elevated DB2 roles enabling access to all obje...

CVE-2017-11614

MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilize...

IBM DB2 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)

According to its version, the installation of IBM DB2 on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the...

IBM DB2 Connect 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)

According to its version, the installation of IBM DB2 Connect on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by...

IBM DB2 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the...

IBM Db2 'Exceptional Conditions' Buffer Overflow Vulnerability - Linux

IBM DB2 is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:db2"; ifdescription...