CVSS: 10.0EPSS: 0%CPEs: 16EXPL: 0CVE-2008-6820
https://notcve.org/view.php?id=CVE-2008-6820
The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with "OS privilege," which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856. El proceso db2fmp en IBM DB2 v8 anterior a FP17, v9.1 anterior a FP5 y v9.5 anterior a FP2 sobre Windows, se ejecuta con "privilegios OS" lo que tiene unos vectores de ataque e impacto desconocidos. Vulnerabilidad distinta de CVE-2008-3856. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT http://osvdb.org/48149 http://www-01.ibm.com/support/docview.wss?uid=swg1JR30026 http://www-01.ibm.com/support/docview.wss?uid=swg1JR30227 http://www-01.ibm.com/support/docview.wss?uid=swg1JR30228 http://www-01.ibm.com/support/docview.wss?uid=swg21318189 http://www.securityfocus.com/bid/31058 • CWE-16: Configuration •
CVSS: 2.6EPSS: 0%CPEs: 18EXPL: 0CVE-2009-1905
https://notcve.org/view.php?id=CVE-2009-1905
The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors. El componente Code Infrastructure en IBM DB2 v8 anterior a FP17 v9.1, anterior a FP7, y v9.5 anterior a FP4, cuando están activadas la seguridad LDAP (aka IBMLDAPauthserver) y las vinculaciones (bind) anónimas, permite a atacantes remotos evitar la autenticación mediante contraseña y establecer una conexión con la base de datos a través de vectores no especificados. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT http://secunia.com/advisories/31787 http://secunia.com/advisories/35235 http://securitytracker.com/id?1022319 http://www-01.ibm.com/support/docview.wss?uid=swg1JR32268 http://www-01.ibm.com/support/docview.wss?uid=swg1JR32272 http://www-01.ibm.com/support/docview.wss?uid=swg1JR32273 http://www-01.ibm.com/support/docview.wss? • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 0%CPEs: 15EXPL: 0CVE-2008-2154 – IBM DB2 install_jar Arbitrary File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2008-2154
IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 provides an INSTALL_JAR (aka sqlj.install_jar) procedure, which allows remote authenticated users to create or overwrite arbitrary files via unspecified calls. IBM DB2 v8 anterior a FP17, v9.1 anterior a FP5 y v9.5 anterior a FP2, ofrece un procedimiento INSTALL_JAR (también conocido como sqlj.install_jar), lo que permite a usuarios autenticados remotamente crear o sobrescribir ficheros de su elección a través de llamadas sin especificar. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is required in that a user must have the ability to connect to the database. The specific flaw exists within the install_jar procedure. The install_jar procedure contains a directory traversal vulnerability that will allow the attacker to upload a Jar file to a directory outside of the intended "\function\jar\Name_of_logged_user\" directory. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT http://osvdb.org/48147 http://secunia.com/advisories/31787 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ21983 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22142 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22143 http://www-01.ibm.com/support/docview.wss?uid=swg21318189 http://www.securityfocus.com/bid/35409 https://exchange.xforce.ibmcloud.com/vulnerabilities/51105 • CWE-16: Configuration •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 2CVE-2009-1906
https://notcve.org/view.php?id=CVE-2009-1906
The DRDA Services component in IBM DB2 9.1 before FP7 and 9.5 before FP4 allows remote attackers to cause a denial of service (memory corruption and application crash) via an IPv6 address in the correlation token in the APPID string, as demonstrated by an APPID string sent by the third-party DataDirect JDBC driver 3.7.32. El componente DRDA Services en IBM DB2 v9.1 anterior a FP7 y v9.5 anterior a FP4, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de una dirección IPv6 en el testigo de correlación en la cadena APPID, como se ha demostrado enviando una cadena APPID por el controlador de terceros DataDirect JDBC v3.7.32. • http://secunia.com/advisories/35235 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ36683 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38874 http://www-01.ibm.com/support/docview.wss?uid=swg21293566 http://www.securityfocus.com/bid/35171 •
CVSS: 5.0EPSS: 25%CPEs: 35EXPL: 1CVE-2009-0172 – IBM DB2 < 9.5 pack 3a - Connect Denial of Service
https://notcve.org/view.php?id=CVE-2009-0172
Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infinite loop) via a crafted CONNECT data stream. Vulnerabilidad no especificada en IBM DB2 v9.1 anterior a FP6a y 9.5 anterior a FP3a permite a atacantes remotos causar denegación de servicio a través de una secuencia de datos CONNECT manipulada. • https://www.exploit-db.com/exploits/8344 ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/33529 http://securitytracker.com/id?1021591 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ37696 http://www-01.ibm.com/sup • CWE-20: Improper Input Validation •