Command injection

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM...

Design/Logic Flaw

IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 163681...

Denial of service

IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398...

Code injection

IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431...

Code injection

IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430...

CVE-2019-4253

CVE-2019-4253 affects IBM Informix Dynamic Server Enterprise Edition 12.1, where a local Informix user could load a malicious shared library to gain root privileges. The issue is a local privilege escalation via library loading. Remediation described in the IBM bulletin is to upgrade Informix to ...

CVE-2018-1796

CVE-2018-1796 affects IBM Informix Dynamic Server Enterprise Edition 12.1, where a local user could load malicious libraries and gain root privileges. The available connected documents indicate the issue is a local privilege escalation through library loading in IDS; remediation in public sources...

CVE-2018-1796

IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426...

CVE-2018-1634

The CVE-2018-1634 issue affects IBM Informix Dynamic Server Enterprise Edition 12.1. A local user with DBA privileges can escalate to root via a symbolic link vulnerability in infos.DBSERVERNAME. What is vulnerable: the infos.DBSERVERNAME symbolic link handling in IDS; root privileges are stated ...

CVE-2018-1635

CVE-2018-1635 – IBM Informix Dynamic Server Enterprise Edition (IDS 12.1) A stack-based buffer overflow in the oninit function can allow an authenticated local user to execute predefined code with root privileges. The vulnerability is reported against IDS Enterprise Edition 12.1 and is characteri...

CVE-2018-1630

IBM Informix Dynamic Server (IDS) Privilege Escalation (CVE-2018-1630) affects IDS v12.10 (Enterprise) where a local DBA can gain root via a symbolic link vulnerability in onmode. The IBM advisory (IDS security bulletin) confirms the root cause as a symbolic link issue and lists a remediation: up...

CVE-2018-1636

Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441...

CVE-2018-1635

Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439...

CVE-2018-1631

IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431...

CVE-2018-1633

CVE-2018-1633 affects IBM Informix Dynamic Server Enterprise Edition 12.1, where a local DBA could exploit a symbolic link vulnerability in onsrvapd to gain root privileges. The IBM/X-Force report and related bulletins confirm a local privilege-escalation issue with IDS/onsrvapd, consistent with ...

CVE-2018-1632

CVE-2018-1632 affects IBM Informix Dynamic Server Enterprise Edition 12.1. A local DBA can escalate to root via a symbolic link vulnerability in the .infxdirs path. IBM and related advisories indicate a fix is available by upgrading to Informix Dynamic Server 12.10.FC13; remediation guidance appe...

CVE-2018-1631

IBM Informix Dynamic Server Enterprise Edition 12.1 is affected by a local privilege-escalation vulnerability (CVE-2018-1631) where a DBA-user can gain root privileges via a symbolic link vulnerability in oninit mongohash. Affected product: IBM Informix Dynamic Server Enterprise Edition 12.1. Roo...

CVE-2018-1630

IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430...

CVE-2018-1636

CVE-2018-1636 affects IBM Informix Dynamic Server Enterprise Edition 12.1. The issue is a stack-based buffer overflow in oninit that, when exploited by an authenticated local user, can execute code with root privileges (local privilege escalation). Remediation per IBM bulletin: upgrade to IBM Inf...

CVE-2019-4483

IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IB...