CVSS: 10.0EPSS: 1%CPEs: 34EXPL: 0CVE-2008-4692
https://notcve.org/view.php?id=CVE-2008-4692
The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors. El componete Native Managed Provider para .NET en IBM DB2 v8 anterior a FP17, v9.1 anteior a FP6, y v9.5 anterior a FP2, cuando un "definer" no puede mantener objetos, conserva las vistas (Views) y los disparadores (triggers) sin señalarlos como desactivados/no operativos para su ejecución, lo que tiene un impacto y vectores de ataque desconocidos. • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT http://secunia.com/advisories/31787 http://secunia.com/advisories/32368 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22287 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22306 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22307 http://www-01.ibm.com/support/docview.wss?uid=swg27013892 http://www.vupen.com/english/advisories/2008/2893 https://exchange.xforce.ibmcloud&# •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2008-4693
https://notcve.org/view.php?id=CVE-2008-4693
The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows attackers to obtain sensitive information by reading "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES." El componente SORT/LIST SERVICES en IBM DB2 v9.1 anterior a FP6 y v9.5 anterior a FP2 escribe información sensible en la salida del trazado (trace), lo que permite a atacantes obtener información sensible mediante la lectura de "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES." • ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT http://secunia.com/advisories/32368 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ23915 http://www-01.ibm.com/support/docview.wss?uid=swg1IZ28489 http://www-01.ibm.com/support/docview.wss?uid=swg27013892 http://www.vupen.com/english/advisories/2008/2893 https://exchange.xforce.ibmcloud.com/vulnerabilities/46022 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.5EPSS: 0%CPEs: 29EXPL: 0CVE-2008-1998
https://notcve.org/view.php?id=CVE-2008-1998
The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter. El procedimiento NNSTAT (también conocido como SYSPROC.NNSTAT) en IBM DB2 8 versiones anteriores a FP16, 9.1 versiones anteriores a FP4a, y 9.5 versiones anteriores a FP1 en Windows permite a usuarios remotos autenticados sobrescribir ficheros de su elección a través del parámetro log file. • http://secunia.com/advisories/29022 http://secunia.com/advisories/29784 http://securityreason.com/securityalert/3840 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776 http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml http://www.securityfocus.com/archive/1/491073/100/0/threaded http://www.securityfocus.com/bid/28836 https://exchange.xforce.ibmcloud • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 0%CPEs: 31EXPL: 0CVE-2008-1997
https://notcve.org/view.php?id=CVE-2008-1997
Unspecified vulnerability in the ADMIN_SP_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMIN_SP_C issue is already covered by CVE-2008-0699. Vulnerabilidad no especificada en el procedimiento ADMIN_SP_C2 de IBM DB2 8 anterior a FP16, 9.1 anterior a FP4a, y 9.5 anterior a FP1; permite a usuarios autenticados en remoto ejecutar código de su elección mediante vectores desconocidos. NOTA: la vulnerabilidad de ADMIN_SP_C ya fue tratada en CVE-2008-0699. • http://secunia.com/advisories/29022 http://securityreason.com/securityalert/3841 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06972 http://www.appsecinc.com/resources/alerts/db2/2008-02.shtml http://www.securityfocus.com/archive/1/491075/100/0/threaded • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.0EPSS: 1%CPEs: 32EXPL: 0CVE-2008-1966
https://notcve.org/view.php?id=CVE-2008-1966
Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVE_JAR procedure with a crafted parameter, related to (a) sqlj.install_jar and (b) sqlj.replace_jar. Múltiples desbordamientos de búfer en las rutinas de administración de archivos JAR en el subcomponente BSU JAVA en IBM DB2 versión 8 anteriores a FP16, versión 9.1 anteriores a FP4a y versión 9.5 anteriores a FP1, permite a usuarios autenticados remotos causar una denegación de servicio (por ejemplo, un bloqueo de instancia) por medio de una llamada al procedimiento (1) RECOVERJAR o (2) REMOVE_JAR_JAR con un parámetro diseñado, relacionado con (a) sqlj.install_jar y (b) sqlj.replace_jar. • http://osvdb.org/46268 http://osvdb.org/46269 http://secunia.com/advisories/29022 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08512 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08945 http://www-1.ibm.com/support/docview.wss?uid=swg1IZ15496 http://www-1.ibm.com/support/docview.wss?uid=swg21255607 http://www.appsecinc.com/resources/alerts/db2/2008-04.shtml http://www.securityfocus.com/archive/1/491071/100/0/threaded http://www.securityfocus.com/bid/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •