CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2009-4438
https://notcve.org/view.php?id=CVE-2009-4438
The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not enforce privilege requirements for access to a (1) sequence or (2) global-variable object, which allows remote authenticated users to make use of data via unspecified vectors. El componente Query Compiler, Rewrite, and Optimizer en IBM DB2 v9.1 anteriores a FP8, v9.5 anteriores a FP5, v9.7 anteriores a FP1 no refuerza los requisitos de privilegios para acceder a (1) una secuencia o (2) objetos de variables globales, permite a usuarios autenticados remotamente usar los datos mediante vectores no especificados. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/37759 http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543 http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583 http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852 http://www-01.ibm.com/support/docview.wss?uid=swg21293566 http://www-01.ibm.com/support/docview.wss? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 0CVE-2009-4328
https://notcve.org/view.php?id=CVE-2009-4328
Unspecified vulnerability in the DRDA Services component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (server trap) by calling a SQL stored procedure in unknown circumstances. Vulnerabilidad sin especificar en el componente DRDA Services en IBM DB2 v9.5 anterior a FP5, permite a usuarios autenticados remotamente provocar una denegación de servicio (trampa del servidor) mediante la llamada en extrañas circunstancias, a un procedimiento de almacenado SQL. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/37759 http://www-01.ibm.com/support/docview.wss?uid=swg1IC64298 http://www-01.ibm.com/support/docview.wss?uid=swg21293566 http://www-01.ibm.com/support/docview.wss?uid=swg21412902 http://www.securityfocus.com/bid/37332 http://www.vupen.com/english/advisories/2009/3520 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 2CVE-2009-4331
https://notcve.org/view.php?id=CVE-2009-4331
The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors. El componente Install en IBM DB2 v9.5 anterior FP5 y v9.7 anterior a FP1, configura las secuencias de comandos High Availability (HA) los permisos de archivos y la autorización de configuración de manera incorrecta, lo que supone un impacto y vectores de ataque locales desconocidos. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT http://secunia.com/advisories/37759 http://www-01.ibm.com/support/docview.wss?uid=swg1IC63581 http://www-01.ibm.com/support/docview.wss?uid=swg1IC63959 http://www-01.ibm.com/support/docview.wss?uid=swg2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 0%CPEs: 37EXPL: 2CVE-2009-4325
https://notcve.org/view.php?id=CVE-2009-4325
The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not validate an unspecified pointer, which allows attackers to overwrite "external memory" via unknown vectors, related to a missing "check for null pointers." El componente Client Interfaces en IBM DB2 v8.2 anterior a FP18, v9.1 anterior a FP8, v9.5 anterior a FP5 y v9.7 anterior a FP1, no valida adecuadamente un puntero no especificado, lo que permite a atacantes sobrescribir la memoria externa a través de vectores desconocidos. Relacionado con la pérdida de "comprobación de punteros nulos". • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT http://secunia.com/advisories/37759 http://www-01.ibm.com/support/docview.wss?uid=swg1IC64702 http://www-01 • CWE-20: Improper Input Validation •
CVSS: 4.6EPSS: 0%CPEs: 19EXPL: 0CVE-2009-4334
https://notcve.org/view.php?id=CVE-2009-4334
The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file. El componente Self Tuning Memory Manager (STMM) en IBM DB2 v9.1 anterior a FP8, v9.5 anterior FP5 y v9.7 anterior a FP1, usa permisos 0666 para el archivos de log STMM, lo que permite a usuarios locales provocar una denegación de servicio o tener un impacto desconocido relacionado con este archivo. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT http://secunia.com/advisories/37759 http://www-01.ibm.com/support/docview.wss?uid=swg1IC64019 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ48106 http://www-01.ibm.com/support/docview.wss?uid=sw • CWE-264: Permissions, Privileges, and Access Controls •