CVE-2017-1451

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128178...

CVE-2017-1451

IBM DB2 LUW 9.7, 10.1, 10.5, and 11.1 (including DB2 Connect Server) are affected by CVE-2017-1451. A local user with DB2 instance owner privileges could obtain root access due to a privilege-escalation flaw. Affected IBM products include DB2 LUW on Linux/Unix/Windows; several IBM security bullet...

PT-2017-13431

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 Description A local user with DB2 instance owner privileges could potentially obtain root access. Recommendations For versions 9.7, 10.1, 10.5, and 11.1, update to a versio...

PT-2017-13401

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows version 11.1 Description The issue could expose highly sensitive information in the error log to a local user under unusual circumstances. Recommendations For IBM DB2 for Linux, UNIX and Windows version 11.1...

PT-2017-13882

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 10.5 through 11.1 Description The issue allows a remote user to cause a disruption of service for DB2 Connect Server setup with a particular configuration. Recommendations For IBM DB2 versions 10.5 through 11.1, at the moment,...

CVE-2017-1520: Improper Authentication

IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830...

CVE-2017-1519: Improper Input Validation

IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup with a particular configuration. IBM X-Force ID: 129829...

CVE-2017-1452: Undefined Security Weakness

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180...

CVE-2017-1451: Undefined Security Weakness

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128178...

CVE-2017-1439: Undefined Security Weakness

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128058...

CVE-2017-1438: Undefined Security Weakness

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user with DB2 instance owner privileges to obtain root access. IBM X-Force ID: 128057...

CVE-2017-1434: Exposure of Sensitive Information to an Unauthorized Actor

IBM DB2 for Linux, UNIX and Windows 11.1 includes DB2 Connect Server under unusual circumstances, could expose highly sensitive information in the error log to a local user...

PT-2017-13893

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7, 10.1, 10.5, and 11.1 Description The issue allows an unauthorized command to activate the database when the authentication type is set to CLIENT. Recommendations For IBM DB2 version 9.7, update to a version that includes ...

Local elevation of privilege vulnerability in multiple IBM DB2 products (CNVD-2017-32877)

IBM DB2 and DB2 Connect Server for Linux, UNIX, and Windows are database products for Linux, UNIX, and Windows platforms from IBM Corporation, U.S.A. DB2 is a relational database management system for use in large application environments.DB2 Connect Server is a DB2 Connect Server is a mainframe...

PT-2017-2969

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 Description The issue is related to insufficient access control in the IBM DB2 database management system and the IBM DB2 Connect Server, which could allow a local user wit...

Five Tips for Getting Started with Scuba Database Vulnerability Scanner

Scuba is a free tool that scans leading enterprise databases for security vulnerabilities and configuration flaws, including patch levels, that allows you to uncover potential database security risks. It includes more than 2,300 assessment tests for Oracle, Microsoft SQL Server, SAP Sybase, IBM D...

Hardcoded credentials

MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilize...

CVE-2017-11614

CVE-2017-11614 involves MEDHOST Connex hard-coded IBM i DB2 user credentials (HMSCXPDN). The vulnerability arises because the password is embedded in multiple locations in the Connex application and cannot be changed by customers, and the account has elevated DB2 roles enabling access to all obje...

CVE-2017-11614

MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilize...

PT-2017-12136

Name of the Vulnerable Software and Affected Versions MEDHOST Connex affected versions not specified Description The issue concerns hard-coded credentials in MEDHOST Connex, which is used for customer database access. An attacker with knowledge of these credentials and direct communication with t...