PT-2015-2779

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through FP10 IBM DB2 versions 9.8 through FP5 IBM DB2 version 10.1 before FP5 IBM DB2 versions 10.5 through FP5 Description The issue is related to the Data Movement implementation in IBM DB2, which has inadequate access...

PT-2015-2778

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through FP10 IBM DB2 versions 9.8 through FP5 IBM DB2 version 10.1 before FP5 IBM DB2 versions 10.5 through FP5 Description The issue is related to a lack of protection for service data in the database management system. I...

PT-2015-2780

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through FP10 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1 before FP5 IBM DB2 versions 10.5 through FP5 Description The issue is related to errors in the code of the scalar-function implementation in IBM DB2, whic...

IBM DB2 Database Automatic Maintenance File Acquisition Vulnerability

IBM DB2 is a set of relational database management system developed by IBM in the United States, and its main operating environments are UNIX including IBM's own AIX, Linux, IBM i formerly known as OS/400, z/OS, and Windows server versions. A security vulnerability exists in IBM DB2 that allows a...

IBM DB2 10.5 <= Fix Pack 5 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 running on the remote host is version 10.5 prior or equal to Fix Pack 5. It is, therefore, affected by one or more of the following vulnerabilities : - An unspecified error exists during the handling of SELECT statements with XML/XSLT function...

IBM DB2 9.7 < Fix Pack 11 Multiple Vulnerabilities (Bar Mitzvah) (FREAK) (TLS POODLE)

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the monitoring and audit features that occurs when handling a specially crafte...

IBM DB2 10.1 < Fix Pack 5 Multiple Vulnerabilities (Bar Mitzvah)

According to its version, the installation of IBM DB2 10.1 running on the remote host is prior to Fix Pack 5. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the monitoring or audit facility due to passwords being stored when handling specially crafted...

Hardcoded credentials

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...

CVE-2014-4875

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...

CVE-2014-4875

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...

CVE-2014-4875

CVE-2014-4875 : In Toshiba CHEC, the CreateBossCredentials.jar file in versions before 6.6 build 4014 and before 6.7 build 4329 contains a hard-coded AES key, enabling an attacker with access to bossinfo.pro to decrypt and obtain the BOSS DB2 credentials. The risk materializes as the potential di...

CVE-2014-4875: Exposure of Sensitive Information to an Unauthorized Actor

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...

PT-2015-3783

Name of the Vulnerable Software and Affected Versions Toshiba CHEC versions prior to 6.6 build 4014 Toshiba CHEC versions 6.7 prior to build 4329 Description The issue concerns a hardcoded AES key in CreateBossCredentials.jar, which can be exploited by attackers to obtain Back Office System Serve...

IBM DB2 9.7.x < 9.7.1000.568 Information Disclosure (credentialed check)

The version of IBM DB2 installed on the remote host is affected by an information disclosure vulnerability due to an unspecified flaw in the monitoring and audit features. A remote, authenticated attacker can exploit this flaw, via a crafted series of commands, to view passwords in SQL statements...

IBM DB2 10.5.x < 10.5.500.109 Information Disclosure (credentialed check)

The version of IBM DB2 installed on the remote host is affected by an information disclosure vulnerability due to an unspecified flaw in the monitoring and audit features. A remote, authenticated attacker can exploit this flaw, via a crafted series of commands, to view passwords in SQL statements...

IBM DB2 10.1.x < 10.1.400.770 Information Disclosure (credentialed check)

The version of IBM DB2 installed on the remote host is affected by an information disclosure vulnerability due to an unspecified flaw in the monitoring and audit features. A remote, authenticated attacker can exploit this flaw, via a crafted series of commands, to view passwords in SQL statements...

CVE-2014-0919

IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities...

CVE-2014-0919

IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities...

Information disclosure

IBM DB2 9.5 through 10.5 on Linux, UNIX, and Windows stores passwords during the processing of certain SQL statements by the monitoring and audit facilities, which allows remote authenticated users to obtain sensitive information via commands associated with these facilities...

CVE-2014-0919

CVE-2014-0919 affects IBM DB2 9.5–10.5 on Linux/UNIX/Windows, where passwords may be exposed during processing of certain SQL statements by the monitoring/audit facilities, exploitable by remote authenticated users. The issue is an information-disclosure vulnerability in the DB2 LUW monitoring/au...