CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2014-0907 – IBM DB2 Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-0907
30 May 2014 — Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library. Múltiples vulnerabilidades de búsqueda de ruta no confiable en programas no especificados (1) setuid y (2) setgid en IBM DB2 9.5, 9.7 anterior a FP9a, 9.8, 10.1 anterior a FP3a y 10.5 anterior a FP3a en Linux y UNIX permiten a usuarios locales ganar ... • http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html •
CVSS: 6.5EPSS: 1%CPEs: 11EXPL: 0CVE-2013-5466
https://notcve.org/view.php?id=CVE-2013-5466
18 Dec 2013 — The XSLT library in IBM DB2 and DB2 Connect 9.5 through 10.5, and the DB2 pureScale Feature 9.8 for Enterprise Server Edition, allows remote authenticated users to cause a denial of service via unspecified vectors. La librería XSLT en IBM DB2 y DB2 Connect 9.5 hasta 10.5, y DB2 pureScale Feature 9.8 para Enterprise Server Edition, permite a usuarios remotos autenticados causar una denegación de servicio a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC97402 •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2013-3475
https://notcve.org/view.php?id=CVE-2013-3475
05 Jun 2013 — Stack-based buffer overflow in db2aud in the Audit Facility in IBM DB2 and DB2 Connect 9.1, 9.5, 9.7, 9.8, and 10.1, as used in Smart Analytics System 7600 and other products, allows local users to gain privileges via unspecified vectors. Desbordamiento de búfer basado en pila en db2aud en Audit Facility de IBM DB2 y DB2 Connect v9.1, v9.5, v9.7, v9.8 y v10.1, como se utiliza en Smart System Analytics 7600 y otros productos, permite a usuarios locales conseguir privilegios a través de vectores no especifica... • http://secunia.com/advisories/52663 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 18%CPEs: 11EXPL: 0CVE-2012-4826
https://notcve.org/view.php?id=CVE-2012-4826
20 Oct 2012 — Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1, 9.5, 9.7 before FP7, 9.8, and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure. Desbordamiento de búfer basado en pila en la infraestructura SQL/PSM (alias SQL Persistent Stored Module) Stored Procedure (SP) en IBM DB2 v9.1, v9.5, v9.7 antes de FP7, v9.8, y v10.1, podría permitir a usuarios remotos autenticados ejecutar código... • http://osvdb.org/86414 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 43EXPL: 0CVE-2012-2194
https://notcve.org/view.php?id=CVE-2012-2194
25 Jul 2012 — Directory traversal vulnerability in the SQLJ.DB2_INSTALL_JAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors. Una vulnerabilidad de salto de directorio en el procedimiento almacenado SQLJ.DB2_INSTALL_JAR en IBM DB2 v9.1 antes de FP12, v9.5 hasta FP9, v9.7 hasta FP6, v9.8 hasta FP5 y v10.1 permite a atacantes remotos reemplazar los archivos JAR a través de vectores no especificados. • http://secunia.com/advisories/49919 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 43EXPL: 0CVE-2012-2196
https://notcve.org/view.php?id=CVE-2012-2196
25 Jul 2012 — IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to read arbitrary XML files via the (1) GET_WRAP_CFG_C or (2) GET_WRAP_CFG_C2 stored procedure. IBM DB2 v9.1 antes de FP12, v9.5 hasta el FP9, v9.7 hasta el FP6, v9.8 hasta el FP5 y v10.1 permite a atacantes remotos leer archivos XML de su elección a través de los procedimientos almacenados (1) GET_WRAP_CFG_C o (2) GET_WRAP_CFG_C2. • http://secunia.com/advisories/49919 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 12%CPEs: 43EXPL: 0CVE-2012-2197
https://notcve.org/view.php?id=CVE-2012-2197
25 Jul 2012 — Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote authenticated users to execute arbitrary code by leveraging certain CONNECT and EXECUTE privileges. Un desbordamiento de búfer basado en pila en la infraestructura de procedimiento almacenado de Java ('Java Stored Procedure infrastructure') en IBM DB2 v9.1 antes de FP12, v9.5 a FP9, v9.7 a FP6, v9.8 a FP5, y v10.1 permite a usuarios rem... • http://secunia.com/advisories/49919 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 0%CPEs: 24EXPL: 0CVE-2012-0709
https://notcve.org/view.php?id=CVE-2012-0709
20 Mar 2012 — IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements. IBM DB2 v9.5 anteriores a vFP9, v9.7 hasta vFP5, y v9.8 hasta vFP4 no comprueban las variables de forma adecuada, lo que permite a usuarios remotos autenticados evitar las restricciones de visionado de datos de tablas, mediante la ele... • http://www-01.ibm.com/support/docview.wss?uid=swg1IC81387 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 38EXPL: 0CVE-2012-0710
https://notcve.org/view.php?id=CVE-2012-0710
20 Mar 2012 — IBM DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Distributed Relational Database Architecture (DRDA) request. IBM DB2 9.1 antes de FP11, 9.5 antes de FP9, 9.7 antes de FP5, y 9.8 antes de FP4 permite a atacantes remotos causar una denegación de servicio (caída de demonio) a través de una solicitud Distributed Relational Database Architecture (DRDA) modificada. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC76781 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 7%CPEs: 41EXPL: 0CVE-2012-0711
https://notcve.org/view.php?id=CVE-2012-0711
20 Mar 2012 — Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.5 before FP9, and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow. Un error de entero sin signo en el proceso db2dasrrm del servidor de administración de DB2 (DAS) en IBM DB2 v9.1 hasta FP11, v9.5 antes de vFP9, y v9.7 hasta FP5 para UNIX permite a atacantes remotos ejecutar código de su el... • http://www-01.ibm.com/support/docview.wss?uid=swg1IC80561 • CWE-189: Numeric Errors •