CVE-2022-43928

The CVE-2022-43928 entry concerns the IBM Toolbox for Java used by Db2 Mirror for i (versions 7.4 and 7.5). The issue arises from processing data with Java strings, which are immutable and remain in memory after use, allowing sensitive data to be visible for an extended time. Reliable details fro...

CVE-2026-16956

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-16956 due to improper neutralization of special elements used in an OS command, enabling remote command execution. The vulnerability impacts IBM Db2 Mirror for i running these versions and is rated CVSS v3.1 base score 9.8 (...

CVE-2023-47741

CVE-2023-47741 affects IBM Db2 Mirror for i web browser clients and IBM i web browser clients on IBM i 7.3–7.5 (and Db2 Mirror for i 7.4–7.5). The issue allows clear-text passwords to linger in browser memory and be viewable via tools before garbage collection, potentially enabling an attacker wi...

CVE-2026-17186

IBM Db2 Mirror for i versions 7.4, 7.5 and 7.6 are affected by CVE-2026-17186, a high-severity vulnerability (OS command injection) that could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command. The issue impacts the GUI-facing...

CVE-2026-17182

CVE-2026-17182 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments (CWE-287). The vulnerability has a high impact: CVSS v3.1 base score 9.8 (...

CVE-2026-17175

CVE-2026-17175 affects IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6). Description: remote authenticated attacker could obtain sensitive information due to improper authentication enforcement. CVSS 3.1 base score 7.5 (HIGH), network attack vector, no user interaction required. Root cause: improper...

CVE-2026-17177

CVE-2026-17177 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. A remote attacker can cause a denial of service via uncontrolled recursion (no authentication required; network vector) as per the IBM/IBM NVD entries. Remediation provided by IBM: apply the following PTFs if using IBM i: 7.4...

CVE-2026-16915

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-16915 due to improper input validation, enabling a remote authenticated attacker to obtain sensitive information. The IBM bulletin documents multiple vulnerabilities in the same product family and lists CVE-2026-16915 under ...

CVE-2026-17081

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17081, where improper limitation of a pathname to a restricted directory could allow a remote attacker to write arbitrary files. The IBM security bulletin lists this alongside other vulnerabilities in the same product and ca...

CVE-2026-17184

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17184, enabling a remote attacker to execute arbitrary code due to external control of a file name or path. The issue affects the GUI and related components of IBM Db2 Mirror for i. IBM’s bulletin lists remediation via platf...

CVE-2026-18554

IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6) is affected by CVE-2026-18554 due to improper limitation of a pathname to a restricted directory, enabling a remote authenticated attacker to obtain sensitive information. This is one of several vulnerabilities listed in IBM’s security bulletin for th...

CVE-2025-36116

Summary: CVE-2025-36116 affects IBM Db2 Mirror for i GUI versions 7.4, 7.5, and 7.6. The vulnerability is a cross-site WebSocket hijacking flaw that could allow an unauthenticated attacker to sniff an existing WebSocket connection and remotely perform operations the user is not allowed to perform...

CVE-2025-36117

CVE-2025-36117 affects IBM Db2 Mirror for i 7.4–7.6. The vulnerability arises because the system does not discard the session id after use, enabling an authenticated user to impersonate another user on the system. Impact is described as session fixation with potential for credential/identity misu...

CVE-2026-17079

CVE-2026-17079 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The issue allows a remote authenticated attacker to bypass security restrictions by disabling server-side input validation through a request parameter. The root cause is improper input validation control that can be manipulat...

CVE-2026-16905

CVE-2026-16905 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. Description: a remote authenticated attacker could obtain sensitive information due to improper authentication. CVSS v3.1 base score 5.3 (MEDIUM), vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Root cause: improper authenticat...

CVE-2026-17181

IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17181, a path traversal vulnerability that could allow a remote attacker to write files to arbitrary locations. The root cause is improper handling of file paths, enabling unauthorized file writes via network-accessible components. According to...

CVE-2026-16879

CVE-2026-16879 affects IBM Db2 Mirror for i 7.4, 7.5, and 7.6. A remote authenticated attacker could bypass security restrictions due to improper authorization from user-supplied input. Impact is high (C/H/I/H) per IBM’s assessment, enabling unauthorized access despite authentication. Root cause:...

CVE-2026-17179

CVE-2026-17179 affects IBM Db2 Mirror for i 7.4, 7.5 and 7.6. A remote authenticated attacker can cause a denial of service via command injection. Root cause: improper neutralization of special elements in an OS command. CVSS reflects high impact on availability (I/L) with overall high severity. ...

CVE-2026-18178

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to delete arbitrary files . The NVD scores this 8.1 (HIGH) with high integrity and availability impact, while IBM rates it 5.4 (MEDIUM) with lower im...

CVE-2026-17173

IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17173, a path-traversal vulnerability caused by improper validation of file paths that could allow a remote authenticated attacker to obtain sensitive information. Affected versions: 7.4, 7.5, 7.6. Remediation: apply IBM PTFs SJ10947 (7.4), SJ1...

CVE-2026-17227

CVE-2026-17227 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. A remote authenticated attacker could bypass security restrictions due to improper neutralization of special elements used in an SQL command (SQL Injection). The IBM bulletin lists this CVE among multiple vulnerabilities in t...

CVE-2026-17209

IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17209: the GUI could be exploited by a remote authenticated attacker to execute arbitrary scripts via cross-site scripting. This aligns with the IBM bulletin listing multiple vulnerabilities in Db2 Mirror for i; the CVSS base score is 6.3 (Medi...