CVE-2023-38728

CVE-2023-38728 affects IBM Db2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 10.5, 11.1, 11.5. Description: denial of service via a specially crafted XML query statement. Classified with a base CVSS about MEDIUM–HIGH depending on vector, and IBM X-Force ID 262258. Connected sources indic...

CVE-2024-27254

CVE-2024-27254 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (versions in the 3.0/4.x line as listed in the remediation table) with a denial-of-service condition from a specially crafted query. The connected Red Hat entry confirms the vulnerability details and scop...

CVE-2024-52903

CVE-2024-52903 affects IBM Db2 for Linux/UNIX/Windows 12.1.0–12.1.1 where a specially crafted query can cause a denial of service server crash. The connected IBM bulletins confirm the issue and provide a remediation path: upgrade Db2 to a fixed build (for V12.1, specifically V12.1.1) via the inte...

CVE-2023-47141

CVE-2023-47141 concerns IBM Db2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 11.5. An authenticated user with CONNECT privileges can trigger a denial of service via a specially crafted query. The provided materials do not specify a concrete remediation version or patch for this CVE; no ...

CVE-2021-39002

CVE-2021-39002 affects IBM DB2 for Linux/UNIX/Windows (incl. DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, 11.5. Description: weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Impact: information disclosure. Affected products appe...

CVE-2023-29255

CVE-2023-29255 affects IBM DB2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 10.5, 11.1, 11.5. Description: a denial of service where a trap may occur while compiling a variation of an anonymous block. Impact per documents: availability may be degraded (DoS) with high severity (CVSS 7.5)...

CVE-2023-38720

CVE-2023-38720 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 11.5 (and 11.5) and Denial of Service via a specially crafted ALTER TABLE statement. The IBM security bulletins indicate the issue can lead to a DoS with basic authentication and network access, with CVSS v3...

CVE-2025-1493

CVE-2025-1493 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 12.1.0–12.1.1. An authenticated user could trigger a denial of service via concurrent execution of shared resources (race condition). IBM’s security bulletins detail a fix path: for V12.1.0, apply Special Bui...

CVE-2020-4414

CVE-2020-4414 affects IBM DB2 products. IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) across versions 9.7, 10.1, 10.5, 11.1 and 11.5 could allow a local attacker to perform unauthorized actions via improper usage of shared memory, potentially obtaining sensitive information o...

CVE-2020-4739

CVE-2020-4739 is a DLL search order hijacking vulnerability in IBM Db2 on Windows client components. The CVE affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) across multiple releases (9.7, 10.1, 10.5, 11.1, 11.5) and requires a local authenticated user to place a crafted...

CVE-2021-38926

CVE-2021-38926 : IBM Db2 for Linux/UNIX/Windows (including Db2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privileges due to modification of columns of existing tasks. The concrete root cause is the ability to modify task columns, leading to privilege...

CVE-2023-40374

CVE-2023-40374 affects IBM Db2 for Linux, UNIX and Windows (Db2 Connect Server) 11.5. It is a denial-of-service vulnerability triggered by a specially crafted query statement. Root cause: the connected documents describe a DoS condition without giving exploit specifics beyond the crafted query. A...

CVE-2024-25030

CVE-2024-25030 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (v3.5–refresh 10, v4.0–refresh 9, v4.5–refresh 3, v4.6–refresh 6, v4.7–refresh 4, v4.8–refresh 4). The issue is that 11.1 releases store potentially sensitive information in log files readable by a local ...

CVE-2024-49350

CVE-2024-49350 affects IBM Db2 on Linux/UNIX/Windows (including DB2 Connect Server). A denial-of-service condition can crash the server under certain crafted queries due to a stack-based buffer overflow in columnar table processing. IBM/Cloud Pak System bulletins reference specific fixes: V11.1.4...

CVE-2023-35012

Summary: CVE-2023-35012 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 11.5 with a Federated configuration. The issue is a stack-based buffer overflow caused by improper bounds checking, enabling a local user with SYSADM privileges to overflow a buffer and execute arbi...

CVE-2021-29678

CVE-2021-29678 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5. A user with DBADM authority could access other databases and read or modify files, indicating an information disclosure vulnerability. The connected IBM bulletins en...

CVE-2023-27555

CVE-2023-27555 affects IBM Db2 for Linux/UNIX/Windows 11.5 (DB2 Connect Server). Description states a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers, with an impact on availability (CVSS base 7.5 in NVD entry, high impact). Connected IBM bulleti...

CVE-2023-45193

CVE-2023-45193 affects IBM Db2 for Linux/UNIX/Windows (including Db2 Connect Server) 11.5 federated server. A denial-of-service condition can be triggered by using a specially crafted cursor, per descriptions in the IBM/Red Hat entries. Root cause cited as vulnerability enabling DoS under crafted...

CVE-2025-2518

CVE-2025-2518 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) in releases 11.5.0–11.5.9 and 12.1.0–12.1.1, where a specially crafted query may cause the server to crash (DoS). IBM/Security Bulletin notes an interim fix: special build 58840 for V11.5 and V12.1. Upgrading...

CVE-2018-1426

CVE-2018-1426 affects IBM GSKit: it duplicates the PRNG state across fork() when multiple ICC instances load, risking duplicate Session IDs and key material. Documents confirm the vulnerability description and its association with GSKit in IBM products; however, a concrete, product-specific fixed...

CVE-2021-20373

CVE-2021-20373 affects IBM Db2 9.7, 10.1, 10.5, 11.1 and 11.5. Under certain circumstances, the LOAD utility may disclose information by not enforcing directory restrictions. This entry is documented in IBM Security Bulletins and IBM X-Force references. The vulnerability is an information disclos...

CVE-2023-38727

CVE-2023-38727 affects IBM Db2 for Linux/UNIX/Windows (10.5, 11.1, 11.5) including Db2 Connect Server. The vulnerability allows a denial of service via a specially crafted SQL statement. IBM X-Force ID: 262257. CVSS v3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The connected IBM bull...

CVE-2023-38740

CVE-2023-38740 affects IBM Db2 on Linux/UNIX/Windows (11.5, including Db2 Connect Server) with a denial of service via a specially crafted SQL statement. The connected IBM advisories confirm this CVE is discussed across multiple IBM security bulletins and cloud/DB2 product lines, indicating conso...

CVE-2023-47152

CVE-2023-47152 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 11.5. The description notes an insecure cryptographic algorithm and information disclosure in a stack trace under exceptional conditions. IBM has published security bulletins referencing this CVE; these advi...

CVE-2009-2858

CVE-2009-2858: IBM DB2 8.1 before FP18 on Unix platforms has a memory leak in the Security component that can cause denial of service via memory consumption due to private memory in the DB2 memory structure. The available connected documents confirm the vulnerability details and affected version,...

CVE-2021-38931

CVE-2021-38931 affects IBM Db2 for Linux, UNIX and Windows (11.1 and 11.5) where a connected user can perform indirect reads on a table they are not authorized to access, causing information disclosure. The Connected documents consistently describe this as part of DB2 vulnerabilities across IBM p...

CVE-2023-40372

CVE-2023-40372 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) 11.5, vulnerable to denial of service via a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499. Reported CVSS base scores in sources range from 5.3 (medium) to 7.5 (high) depending...

CVE-2024-22360

CVE-2024-22360 (IBM Db2 on Cloud Pak for Data) is a denial-of-service issue triggered by a specially crafted query on certain columnar tables. Affected products include IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, with versions listed as v3.5 through various refresh leve...

CVE-2024-25046

CVE-2024-25046 affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Authenticated user can trigger a denial of service via a specially crafted query against Db2 components (versions 3.5 through latest refresh). The issue has a remediation path: upgrade to the latest Cloud...

CVE-2024-41762

CVE-2024-41762 affects IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 10.5, 11.1 and 11.5, causing a denial of service via a specially crafted query that may crash the server due to memory allocation issues. The connected IBM Cloud Pak for Data bulletin confirms multip...

CVE-2023-40687

CVE-2023-40687 affects IBM Db2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 10.5, 11.1, 11.5, enabling denial of service via a specially crafted RUNSTATS command on an 8TB table. Public docs confirm the issue and its IBM X-Force ID (264809). The provided connected materials indicate a r...

CVE-2010-3731

CVE-2010-3731 : IBM DB2’s DAS component (db2dasrrm) in DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 contains a stack-based buffer overflow in validateUser (DasSysCmd), enabling a remote attacker to execute arbitrary code via a long username string. Connected sources confirm multiple v...

CVE-2014-0907

CVE-2014-0907 is a local privilege-escalation vulnerability affecting IBM DB2 and IBM Tivoli products shipped with DB2 components. The issue arises from untrusted search paths and Trojan-horse libraries in setuid/setgid contexts, allowing a local user to gain root-equivalent privileges on affecte...

CVE-2023-29267

CVE-2023-29267: IBM Db2 for Linux, UNIX and Windows (incl. Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to a denial-of-service when a specially crafted SQL statement is used by an authenticated user, potentially crashing the server under certain configurations. The connected IBM security bu...

CVE-2025-36122

CVE-2025-36122 affects IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.3 for Linux, UNIX and Windows (including DB2 Connect Server). An authenticated user can cause a denial of service via a specially crafted SQL query due to improper allocation of system resources when stmtheap is set to AUTOMATIC. CVSS v...

CVE-2022-41296

CVE-2022-41296 affects IBM Db2U on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Affected: Db2U 3.5–4.5 (releases 3.5 up to refresh 10, 4.0 up to refresh 9, 4.5 up to refresh 3). Root cause: cross-site request forgery allowing an attacker to perform malicious/unauthorized actions tr...

CVE-2023-45178

CVE-2023-45178 affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) 11.5 CLI. Description: vulnerability to denial of service when a specially crafted request is used. Root cause: CWE-20 Improper Input Validation. Evidence: IBM X-Force entry for the CVE-2023-45178 shows a ba...

CVE-2007-2582

The IBM DB2JDS vulnerability (CVE-2007-2582) in IBM DB2 9.x and earlier allows remote code execution via a crafted packet to the DB2JDS service on TCP port 6789, and also DoS through an invalid LANG parameter or an oversized packet causing a MemTree overflow. IBM TRIRIGA Application Platform is n...

CVE-2025-13755

CVE-2025-13755 affects IBM Db2 11.5.0–11.5.9 and 12.1.0–12.1.4 (Linux/UNIX/Windows, including Db2 Connect Server). The root cause is that the system can store potentially sensitive information in log files, which could be read by a local user, constituting a credential exposure (CWE-532). Impact ...

CVE-2025-3050

CVE-2025-3050 affects IBM Db2 for Linux/UNIX/Windows (incl. DB2 Connect Server) versions 11.5.0–11.5.9 and 12.1.0–12.1.1. The IBM bulletin describes a denial-of-service risk where an authenticated user could exhaust CPU resources when using Q replication due to improper CPU allocation. The vulner...

CVE-2017-1297

CVE-2017-1297 affects IBM DB2 for Linux/UNIX/Windows (including DB2 Connect Server). The vulnerability is a stack-based buffer overflow caused by improper bounds checking in the CLP path, which could allow a local attacker to execute arbitrary code. In affected IBM DB2 LUW releases (notably 9.2/1...

CVE-2023-27867

CVE-2023-27867 affects IBM Db2 JDBC Driver for Db2 on Linux/UNIX/Windows (10.5, 11.1, 11.5). A remote authenticated attacker could execute arbitrary code via JNDI Injection by sending a crafted request using the clientRerouteServerListJNDIName property. The connected IBM advisories confirm this i...

CVE-2024-37071

CVE-2024-37071 affects IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) on 10.5, 11.1, and 11.5. An authenticated user could cause a denial of service via a specially crafted query due to improper memory allocation (memory allocation flaw). Affected products include Db2/Db2 Conne...

CVE-2011-0731

CVE-2011-0731 describes a buffer overflow in the IBM DB2 Administration Server (DAS) component. Affected products/versions include IBM DB2 9.1 prior to FP10, 9.5 prior to FP7, and 9.7 prior to FP3 running on Linux, UNIX, and Windows. The flaw allows a remote attacker to execute arbitrary code or ...

CVE-2019-4386

CVE-2019-4386 affects IBM DB2 for Linux, UNIX and Windows (incl. DB2 Connect Server). Affected versions include Db2 11.1 (and related 10.x/9.x lines per bulletins) where an authenticated user can execute a function that crashes the server. The issue is documented across IBM bulletins linked in th...

CVE-2020-4642

Summary: CVE-2020-4642 affects IBM DB2 for Windows (incl. DB2 Connect Server) across 9.7, 10.1, 10.5, 11.1 and 11.5, allowing a local attacker to cause a denial of service inside the DB2 Management Service. Linux/UNIX are not affected. The IBM Security Bulletin documents a DoS condition with a ba...

CVE-2023-27859

Summary: CVE-2023-27859 affects IBM Db2 on Linux/UNIX/Windows (Db2 10.1, 10.5, 11.1) where a remote attacker could execute arbitrary code by installing a malicious jar that overwrites a like-named jar across databases. The underlying issue is a jar-file installation/overwrite path that spans mult...

CVE-2023-38003

CVE-2023-38003 – IBM Db2 privilege escalation : A user with DATAACCESS privileges could execute routines they should not access in Db2 for Linux/UNIX/Windows (Db2 Connect Server) 10.5, 11.1, 11.5. The IBM X-Force advisory reports a base score of 7.2 (HIGH) with network attack vector and high impa...

CVE-2024-40679

CVE-2024-40679 affects IBM Db2 for Linux/UNIX/Windows (including Db2 Connect Server) version 11.5. It is an information-disclosure vulnerability where sensitive data may be written to a log file under certain conditions (CWE-532: Insertion of Sensitive Information into Log File). The IBM-connecte...

CVE-2020-4885

CVE-2020-4885 affects IBM Db2 LUW 11.5 (and Db2 Connect Server). Root cause is a race condition involving a symbolic link that lets a local user access and change Db2 configuration. The connected IBM bulletins describe remediation through upgrade paths to fixed DB2 versions (e.g., DB2 v11.5.7 / C...