Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
IbmDb2 Universal Database*

26 matches found

CVE
CVE•added 2008/02/13 12:0 a.m.•56 views

CVE-2007-5757

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as CVE-2008-0...

6.9CVSS6.1AI score0.00058EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•55 views

CVE-2007-4271

Directory traversal vulnerability in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary files via a .. (dot dot) in an unspecified environment variable, which is appended to "/tmp/" and used as a log file. NOTE: this issue might be related to symlink follo...

2.1CVSS6AI score0.00036EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•55 views

CVE-2007-4275

Multiple untrusted search path vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain privileges via certain vectors related to (1) DB2 instance or FMP startup on Linux and Solaris; (2) exec of executables while running as root on non-Windows systems, as...

6.9CVSS6.5AI score0.00055EPSS
CVE
CVE•added 2007/02/23 10:28 p.m.•54 views

CVE-2007-1089

IBM DB2 Universal Database (UDB) 9.1 GA through 9.1 FP1 allows local users with table SELECT privileges to perform unauthorized UPDATE and DELETE SQL commands via unknown vectors.

7.2CVSS6.6AI score0.0005EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•51 views

CVE-2007-4270

Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.

6.9CVSS6.3AI score0.00047EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•51 views

CVE-2007-6048

IBM DB2 UDB 9.1 before Fixpak 4 uses incorrect permissions on ACLs for DB2NODES.CFG, which has unknown impact and attack vectors. NOTE: the vendor description of this issue is too vague to be certain that it is security-related.

10CVSS6.3AI score0.0076EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•50 views

CVE-2007-4276

Stack-based buffer overflow in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows attackers to execute arbitrary code via a long DASPROF and possibly other environment variables, which are copied into the buildDasPaths buffer.

6.9CVSS7.6AI score0.00092EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•49 views

CVE-2007-4418

IBM DB2 UDB 8 before Fixpak 15 does not properly check authorization, which allows remote authenticated users with a certain SELECT privilege to have an unknown impact via unspecified vectors. NOTE: this issue is probably related to CVE-2007-1089, but this is uncertain due to lack of details.

5.5CVSS6.1AI score0.00738EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•47 views

CVE-2007-6046

Unspecified vulnerability in unspecified setuid programs in IBM DB2 UDB 9.1 before Fixpak 4 allows local users to have an unknown impact.

7.2CVSS6.1AI score0.00048EPSS
CVE
CVE•added 2010/10/05 6:0 p.m.•47 views

CVE-2010-3739

The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection (aka CONNECT and AUTHENTICATION) events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers...

6.4CVSS6.6AI score0.00246EPSS
CVE
CVE•added 2006/06/19 10:2 a.m.•46 views

CVE-2006-3066

Buffer overflow in the TCP/IP listener in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allows remote attackers to cause a denial of service (application crash) via a long MGRLVLLS message inside of an EXCSAT message when establishing a connection.

5CVSS6.7AI score0.01562EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•46 views

CVE-2007-4273

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary directories and execute arbitrary code via a "crafted localized message file" that enables a format string attack, possibly involving the (1) OSSEMEMDBG or (2) TRC_LOG_FILE environment variable in db2licd ...

4.6CVSS6.9AI score0.00079EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•46 views

CVE-2007-6045

Unspecified vulnerability in (1) DB2WATCH and (2) DB2FREEZE in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors.

10CVSS6.4AI score0.01003EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•45 views

CVE-2007-6053

IBM DB2 UDB 9.1 before Fixpak 4 does not properly handle use of large numbers of file descriptors, which might allow attackers to have an unknown impact involving "memory corruption." NOTE: the vendor description of this issue is too vague to be certain that it is security-related.

9.3CVSS6.3AI score0.00435EPSS
CVE
CVE•added 2008/08/28 5:41 p.m.•44 views

CVE-2008-3852

Unspecified vulnerability in the CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio in the Visual Studio Net component in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2 allows remote authenticated users to execute arbitrary code via unknown vectors.

6.5CVSS6.8AI score0.03183EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•42 views

CVE-2007-6051

IBM DB2 UDB 9.1 before Fixpak 4 assigns incorrect privileges to the (1) DB2ADMNS and (2) DB2USERS alternative groups, which has unknown impact. NOTE: the vendor description of this issue is too vague to be certain that it is security-related.

10CVSS6.3AI score0.00478EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•41 views

CVE-2007-6049

Unspecified vulnerability in the SSL LOAD GSKIT action in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, involving a call to dlopen when the effective uid is root.

7.2CVSS6.3AI score0.00064EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•40 views

CVE-2007-4272

Multiple vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to create arbitrary files via (1) unspecified vectors where an attacker's umask is honored, (2) /etc/ld.so.preload, (3) certain "cron data file locations", and other unspecified vectors possibly inv...

1.9CVSS6.4AI score0.00065EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•40 views

CVE-2007-6050

Unspecified vulnerability in DB2LICD in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, related to creation of an "insecure directory."

7.2CVSS6.3AI score0.00056EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•40 views

CVE-2007-6052

IBM DB2 UDB 9.1 before Fixpak 4 does not properly perform vector aggregation, which might allow attackers to cause a denial of service (divide-by-zero error and DBMS crash), related to an "overflow." NOTE: the vendor description of this issue is too vague to be certain that it is security-related.

7.8CVSS6.3AI score0.00421EPSS
CVE
CVE•added 2007/08/18 9:17 p.m.•39 views

CVE-2007-4417

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.

6CVSS6.4AI score0.00943EPSS
CVE
CVE•added 2008/09/11 1:13 a.m.•39 views

CVE-2008-3960

Unspecified vulnerability in the JDBC Applet Server Service (aka db2jds) in IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (service crash) via "malicious packets."

5CVSS6.2AI score0.01419EPSS
CVE
CVE•added 2003/11/17 5:0 a.m.•38 views

CVE-2003-0898

IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2.

4.6CVSS6.8AI score0.0118EPSS
CVE
CVE•added 2006/06/19 10:2 a.m.•38 views

CVE-2006-3067

Multiple unspecified vulnerabilities in IBM DB2 Universal Database (UDB) before 8.1 FixPak 12 allow remote attackers to cause a denial of service (application crash) via a (1) "long column list" in the (a) REPLACE INTO and (b) INSERT INTO portions of the LOAD command or a (2) large number of values...

5CVSS7.5AI score0.01628EPSS
CVE
CVE•added 2007/11/20 8:46 p.m.•38 views

CVE-2007-6047

Unspecified vulnerability in the DB2DART tool in IBM DB2 UDB 9.1 before Fixpak 4 allows attackers to execute arbitrary commands as the DB2 instance owner, related to invocation of TPUT by DB2DART.

10CVSS7.2AI score0.00651EPSS
CVE
CVE•added 2008/08/28 5:41 p.m.•37 views

CVE-2008-3856

The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.

7.5CVSS6.1AI score0.00833EPSS