CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2009-1905
https://notcve.org/view.php?id=CVE-2009-1905
03 Jun 2009 — The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors. El componente Code Infrastructure en IBM DB2 v8 anterior a FP17 v9.1, anterior a FP7, y v9.5 anterior a FP4, cuando están activadas la seguridad LDAP (aka IBMLDAPauthserver) y las vinculaciones (bind) anónimas, perm... • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 0%CPEs: 16EXPL: 0CVE-2008-6820
https://notcve.org/view.php?id=CVE-2008-6820
03 Jun 2009 — The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with "OS privilege," which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856. El proceso db2fmp en IBM DB2 v8 anterior a FP17, v9.1 anterior a FP5 y v9.5 anterior a FP2 sobre Windows, se ejecuta con "privilegios OS" lo que tiene unos vectores de ataque e impacto desconocidos. Vulnerabilidad distinta de CVE-2008-3856. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT • CWE-16: Configuration •
CVSS: 9.0EPSS: 0%CPEs: 15EXPL: 0CVE-2008-2154 – IBM DB2 install_jar Arbitrary File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2008-2154
03 Jun 2009 — IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 provides an INSTALL_JAR (aka sqlj.install_jar) procedure, which allows remote authenticated users to create or overwrite arbitrary files via unspecified calls. IBM DB2 v8 anterior a FP17, v9.1 anterior a FP5 y v9.5 anterior a FP2, ofrece un procedimiento INSTALL_JAR (también conocido como sqlj.install_jar), lo que permite a usuarios autenticados remotamente crear o sobrescribir ficheros de su elección a través de llamadas sin especificar. This vulner... • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT • CWE-16: Configuration •
CVSS: 10.0EPSS: 2%CPEs: 15EXPL: 0CVE-2008-6821
https://notcve.org/view.php?id=CVE-2008-6821
03 Jun 2009 — Buffer overflow in the DAS server in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 might allow attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, a different vulnerability than CVE-2007-3676 and CVE-2008-3853. Desbordamiento de búfer en el servidor DAS en IBM DB2 v8 anterior a la FP17, v9.1 anterior a la FP5 y v9.5 anterior a FP2, podría permitir a atacantes ejecutar código de su elección o provocar una denegación de servicio (caída de a... • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 2CVE-2009-1906
https://notcve.org/view.php?id=CVE-2009-1906
03 Jun 2009 — The DRDA Services component in IBM DB2 9.1 before FP7 and 9.5 before FP4 allows remote attackers to cause a denial of service (memory corruption and application crash) via an IPv6 address in the correlation token in the APPID string, as demonstrated by an APPID string sent by the third-party DataDirect JDBC driver 3.7.32. El componente DRDA Services en IBM DB2 v9.1 anterior a FP7 y v9.5 anterior a FP4, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicaci... • http://secunia.com/advisories/35235 •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2009-1239
https://notcve.org/view.php?id=CVE-2009-1239
03 Apr 2009 — IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate and an OUTER JOIN predicate, which might allow attackers to obtain sensitive information via a crafted query. IBM DB2 v9.1 anteriores a FP7 devuelve resultados incorrectos en ciertas situaciones relacionadas con la orden de aplicación de una identificación INNER JOIN y una identificación OUTER JOIN, lo que permitiría a atacantes conseguir información sensible a través d... • http://www-01.ibm.com/support/docview.wss?uid=swg1JR31886 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 2%CPEs: 35EXPL: 0CVE-2009-0173
https://notcve.org/view.php?id=CVE-2009-0173
16 Jan 2009 — Unspecified vulnerability in the server in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote authenticated users to cause a denial of service (trap) via a crafted data stream. Vulnerabilidad no especificada en el servidor en IBM DB2 v9.1 anterior a FP6 y v9.5 anterior a FP3a permite a atacantes remotos causar denegación de servicio (trampa) a través de una secuencia de datos manipulada. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 5%CPEs: 35EXPL: 1CVE-2009-0172 – IBM DB2 < 9.5 pack 3a - Connect Denial of Service
https://notcve.org/view.php?id=CVE-2009-0172
16 Jan 2009 — Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infinite loop) via a crafted CONNECT data stream. Vulnerabilidad no especificada en IBM DB2 v9.1 anterior a FP6a y 9.5 anterior a FP3a permite a atacantes remotos causar denegación de servicio a través de una secuencia de datos CONNECT manipulada. • https://www.exploit-db.com/exploits/8344 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 1%CPEs: 34EXPL: 0CVE-2008-4692
https://notcve.org/view.php?id=CVE-2008-4692
22 Oct 2008 — The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors. El componete Native Managed Provider para .NET en IBM DB2 v8 anterior a FP17, v9.1 anteior a FP6, y v9.5 anterior a FP2, cuando un "definer" no puede mantener objetos, conserva las vistas (Views) y los disparadores (triggers) sin señalarl... • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2008-4693
https://notcve.org/view.php?id=CVE-2008-4693
22 Oct 2008 — The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows attackers to obtain sensitive information by reading "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES." El componente SORT/LIST SERVICES en IBM DB2 v9.1 anterior a FP6 y v9.5 anterior a FP2 escribe información sensible en la salida del trazado (trace), lo que permite a atacantes obtener información sensible mediante la lectura de "PASSWORD-RELATED CONNECTION STRING K... • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •