CVSS: 4.3EPSS: 1%CPEs: 21EXPL: 0CVE-2008-3858
https://notcve.org/view.php?id=CVE-2008-3858
The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7 client connect request. El componente Downlevel DB2RA Support en IBM DB2 9.1 antes de Fixpak 4a permite a atacantes remotos provocar una denegación de servicio (caída de instancia) mediante un flujo de datos CONNECT manipulado que simula una petición de conexión de cliente V7. • http://osvdb.org/48428 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ07299 http://www-1.ibm.com/support/docview.wss?uid=swg21255607 http://www.securityfocus.com/bid/29601 https://exchange.xforce.ibmcloud.com/vulnerabilities/45138 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 4%CPEs: 16EXPL: 0CVE-2008-3853
https://notcve.org/view.php?id=CVE-2008-3853
Buffer overflow in the DAS server program in the Core DAS function component in IBM DB2 9.1 before FP4a and 9.5 before FP1 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via unspecified vectors. NOTE: this might be related to CVE-2007-3676. Desbordamiento de búfer en el programa DAS server en el componente de la función Core DAS en IBM DB2 9.1 antes del Fixpak 4a permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída del demonio) mediante vectores no especificados. NOTA: esto podría estar relacionado con CVE-2008-0698. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/29784 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ12406 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ12379 http://www-1.ibm.com/support/docview.wss?uid=swg21255607 http://www.securityfocus.com/bid/29601 https://exchange.xforce.ibmcloud.com/vulnerabilities/45141 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 119EXPL: 0CVE-2008-3856
https://notcve.org/view.php?id=CVE-2008-3856
The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors. El componente routine infrastructure en DB2 de IBM versión 8 anterior a FP17, versión 9.1 anterior a FP5 y versión 9.5 anterior a FP1, en Unix y Linux, no cambia la propiedad del proceso db2fmp, que presenta un impacto y vectores de ataque desconocidos. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/29784 http://secunia.com/advisories/31787 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ19155 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20350 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20352 http://www-1.ibm.com/support/docview.wss?uid= • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.5EPSS: 0%CPEs: 29EXPL: 0CVE-2008-1998
https://notcve.org/view.php?id=CVE-2008-1998
The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter. El procedimiento NNSTAT (también conocido como SYSPROC.NNSTAT) en IBM DB2 8 versiones anteriores a FP16, 9.1 versiones anteriores a FP4a, y 9.5 versiones anteriores a FP1 en Windows permite a usuarios remotos autenticados sobrescribir ficheros de su elección a través del parámetro log file. • http://secunia.com/advisories/29022 http://secunia.com/advisories/29784 http://securityreason.com/securityalert/3840 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776 http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml http://www.securityfocus.com/archive/1/491073/100/0/threaded http://www.securityfocus.com/bid/28836 https://exchange.xforce.ibmcloud • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 0%CPEs: 31EXPL: 0CVE-2008-1997
https://notcve.org/view.php?id=CVE-2008-1997
Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699. Vulnerabilidad no especificada en el procedimiento ADMIN_SP_C2 de IBM DB2 8 anterior a FP16, 9.1 anterior a FP4a, y 9.5 anterior a FP1; permite a usuarios autenticados en remoto ejecutar código de su elección mediante vectores desconocidos. NOTA: la vulnerabilidad de ADMIN_SP_C ya fue tratada en CVE-2008-0699. • http://secunia.com/advisories/29022 http://securityreason.com/securityalert/3841 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06972 http://www.appsecinc.com/resources/alerts/db2/2008-02.shtml http://www.securityfocus.com/archive/1/491075/100/0/threaded • CWE-94: Improper Control of Generation of Code ('Code Injection') •