Ibm Db2 vulnerabilities

322 known vulnerabilities affecting ibm/db2.

Total CVEs

322

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL13HIGH138MEDIUM156LOW15

Vulnerabilities

Page 5 of 17

CVE-2023-46167HIGHCVSS 7.5≥ 11.5.6, ≤ 11.5.82023-12-04

CVE-2023-46167 [HIGH] CWE-20 CVE-2023-46167: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerabl IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used. IBM X-Force ID: 269367.

nvd

CVE-2023-40687HIGHCVSS 7.5≤ 10.5.0.11≥ 11.1.0.0, ≤ 11.1.4.7+1 more2023-12-04

CVE-2023-40687 [HIGH] CWE-20 CVE-2023-40687: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB table. IBM X-Force ID: 264809.

nvd

CVE-2023-29258HIGHCVSS 7.5≥ 11.1.0.0, ≤ 11.1.4.7≥ 11.5, ≤ 11.5.92023-12-04

CVE-2023-29258 [HIGH] CWE-20 CVE-2023-29258: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated query on specific federation objects. IBM X-Force ID: 252048.

nvd

CVE-2023-38727HIGHCVSS 7.5≥ 10.5.0.0, ≤ 10.5.0.11≥ 11.1.0.0, ≤ 11.1.4.7+1 more2023-12-04

CVE-2023-38727 [HIGH] CWE-20 CVE-2023-38727: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statement. IBM X-Force ID: 262257.

nvd

CVE-2023-45178HIGHCVSS 7.5v11.52023-12-03

CVE-2023-45178 [HIGH] CWE-20 CVE-2023-45178: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM X-Force ID: 268073.

nvd

CVE-2023-40373HIGHCVSS 7.5≥ 11.5, ≤ 11.5.8v10.5+1 more2023-10-17

CVE-2023-40373 [HIGH] CWE-20 CVE-2023-40373: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574.

nvd

CVE-2023-40372HIGHCVSS 7.5≥ 11.5, ≤ 11.5.82023-10-17

CVE-2023-40372 [HIGH] CWE-20 CVE-2023-40372: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of se IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499.

nvd

CVE-2023-38719MEDIUMCVSS 4.4v11.5.82023-10-17

CVE-2023-38719 [MEDIUM] CWE-20 CVE-2023-38719: IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during da IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607.

nvd

CVE-2023-38740HIGHCVSS 7.5≥ 11.5, ≤ 11.5.82023-10-16

CVE-2023-38740 [HIGH] CWE-20 CVE-2023-38740: IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-Force ID: 262613.

nvd

CVE-2023-38720HIGHCVSS 7.5≥ 11.5, < 11.5.8v11.1.42023-10-16

CVE-2023-38720 [HIGH] CWE-20 CVE-2023-38720: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to den IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616.

nvd

CVE-2023-30991HIGHCVSS 7.5≥ 11.5, ≤ 11.5.8v11.1.42023-10-16

CVE-2023-30991 [HIGH] CWE-20 CVE-2023-30991: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to den IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force ID: 254037.

nvd

CVE-2023-38728HIGHCVSS 7.5≥ 11.5, < 11.5.8v10.5+1 more2023-10-16

CVE-2023-38728 [HIGH] CWE-20 CVE-2023-38728: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258.

nvd

CVE-2023-30987HIGHCVSS 7.5≥ 11.5, < 11.5.8v10.5+1 more2023-10-16

CVE-2023-30987 [HIGH] CWE-20 CVE-2023-30987: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain databases. IBM X-Force ID: 253440.

nvd

CVE-2023-40374HIGHCVSS 7.5≥ 11.5, ≤ 11.5.82023-10-16

CVE-2023-40374 [HIGH] CWE-20 CVE-2023-40374: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of se IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Force ID: 263575.

nvd

CVE-2023-35012MEDIUMCVSS 6.7v11.52023-07-17

CVE-2023-35012 [MEDIUM] CWE-121 CVE-2023-35012: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuratio IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763.

nvd

CVE-2023-30448HIGHCVSS 7.5v10.5.0.11v11.1.4.7+1 more2023-07-10

CVE-2023-30448 [HIGH] CWE-20 CVE-2023-30448: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437.

nvd

CVE-2023-30447HIGHCVSS 7.5v10.5.0.11v11.1.4.7+1 more2023-07-10

CVE-2023-30447 [HIGH] CWE-20 CVE-2023-30447: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253436.

nvd

CVE-2023-27867HIGHCVSS 8.8v10.5.0.11v11.1.4.7+1 more2023-07-10

CVE-2023-27867 [HIGH] CWE-94 CVE-2023-27867: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote au IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Forc

nvd

CVE-2023-30442HIGHCVSS 7.5v11.1.4.7v11.52023-07-10

CVE-2023-30442 [HIGH] CWE-20 CVE-2023-30442: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202.

nvd

CVE-2023-27558HIGHCVSS 7.8v10.5.0.11v11.1.4.7+1 more2023-07-10

CVE-2023-27558 [HIGH] CWE-269 CVE-2023-27558: IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at lea IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194.

nvd

← Previous5 / 17Next →