Design/Logic Flaw

The DB2DART program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 allows attackers to bypass intended file access restrictions via unspecified vectors related to overwriting files owned by an instance owner...

Design/Logic Flaw

Unspecified vulnerability in the DB2STST program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 has unknown impact and attack vectors...

Code injection

Unspecified vulnerability in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 on Windows Server 2008 allows attackers to cause a denial of service trap via vectors involving "special group and user enumeration."...

Code injection

IBM DB2 9.7 before FP2, when AUTOREVAL is IMMEDIATE, allows remote authenticated users to cause a denial of service loss of privileges to a view owner by defining a dependent view...

Code injection

IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2010-3194

The DB2DART program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 allows attackers to bypass intended file access restrictions via unspecified vectors related to overwriting files owned by an instance owner...

CVE-2010-3193

CVE-2010-3193 is an unspecified vulnerability in the IBM DB2 DB2STST program affecting IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2. Connected sources indicate a concrete root cause: a privilege escalation vulnerability exists in DB2STST on Linux/Unix (IC65703). Public references sh...

CVE-2010-3197

CVE-2010-3197 affects IBM DB2 9.7 before FP2. The vulnerability lies in the SYSIBMADM monitor administrative views where access control is not enforced as expected, potentially allowing remote attackers to obtain sensitive information via unspecified vectors. Public sources confirm multiple vulne...

CVE-2010-3196

IBM DB2 9.7 before FP2 is affected when AUTO_REVAL is set to IMMEDIATE. A remote authenticated user can cause a denial of service (loss of privileges) to a view owner by defining a dependent view. The remediation is to apply Fix Pack 2 (FP2) for DB2 9.7 to mitigate the issue.

CVE-2010-3194

CVE-2010-3194 affects IBM DB2 via the DB2DART program. The vulnerability allows bypass of file access restrictions by overwriting files owned by the instance owner in DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2. The initial description notes bypass via unspecified vectors related to ov...

CVE-2010-3193

Unspecified vulnerability in the DB2STST program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 has unknown impact and attack vectors...

CVE-2010-3195

Unspecified vulnerability in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 on Windows Server 2008 allows attackers to cause a denial of service trap via vectors involving "special group and user enumeration."...

CVE-2010-3195

CVE-2010-3195 affects IBM DB2 9.1 (before FP9), 9.5 (before FP6), and 9.7 (before FP2) on Windows Server 2008. The vulnerability is described as an unspecified issue that allows an attacker to cause a denial of service (trap) via vectors involving “special group and user enumeration.” The Connect...

CVE-2010-3197

IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2010-3196

IBM DB2 9.7 before FP2, when AUTOREVAL is IMMEDIATE, allows remote authenticated users to cause a denial of service loss of privileges to a view owner by defining a dependent view...

drda-brute NSE Script

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby Script Arguments drda-brute.threads the amount of accounts to attempt to brute force in parallel default 10. drda-brute.dbname the database name against which to guess passwords default...

IBM Tivoli Directory Server ldapinst.log DB2 Admin Password Disclosure

The remote installation of Tivoli Directory Server created a file called 'ldapinst.log' that contains the login and password of the IBM DB2 database used for this service. An attacker who could get access to this file or a backup of it would be able to log into the DB2 database and modify its...

IBM DB2 9.1 < 9.1 Fix Pack 10 Multiple Vulnerabilities

Binary data 5749.prm...

IBM DB2 9.7 < 9.7 Fix Pack 2 Multiple Vulnerabilities

Binary data 5556.prm...

IBM DB2 9.7 < Fix Pack 2 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 9.7 running on the remote host is affected by one or more of the following issues : - The 'MODIFIED SQL DATA' table function is not dropped when a definer loses required privileges to maintain the objects. IC63548 - A privilege escalation...