Ibm Db2 vulnerabilities
332 known vulnerabilities affecting ibm/db2.
Total CVEs
332
CISA KEV
0
Public exploits
5
Exploited in wild
0
Severity breakdown
CRITICAL13HIGH142MEDIUM162LOW15
Vulnerabilities
Page 7 of 17
CVE-2023-26021HIGHCVSS 7.5≥ 11.1, < 11.1.4≥ 11.5, < 11.5.8+1 more2023-04-28
CVE-2023-26021 [HIGH] CWE-20 CVE-2023-26021: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a d
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864.
nvd
CVE-2023-25930MEDIUMCVSS 5.9≥ 11.1, < 11.1.4≥ 11.5, < 11.5.8+2 more2023-04-28
CVE-2023-25930 [MEDIUM] CWE-20 CVE-2023-25930: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862.
nvd
CVE-2023-29255HIGHCVSS 7.5≥ 11.1, < 11.1.4≥ 11.5, < 11.5.8+2 more2023-04-27
CVE-2023-29255 [HIGH] CWE-20 CVE-2023-29255: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable
IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991.
nvd
CVE-2023-27559HIGHCVSS 7.5≥ 11.1, < 11.1.4≥ 11.5, < 11.5.8+2 more2023-04-26
CVE-2023-27559 [HIGH] CWE-20 CVE-2023-27559: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196.
nvd
CVE-2023-29257HIGHCVSS 7.2≥ 11.1, < 11.1.4≥ 11.5, < 11.5.8+2 more2023-04-26
CVE-2023-29257 [HIGH] CVE-2023-29257: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011.
nvd
CVE-2022-43930HIGHCVSS 7.5v10.5v11.1+1 more2023-02-17
CVE-2022-43930 [HIGH] CWE-200 CVE-2022-43930: IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure
IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IBM X-Force ID: 241677.
nvd
CVE-2022-43927HIGHCVSS 7.5v10.5v11.1+1 more2023-02-17
CVE-2022-43927 [HIGH] CWE-200 CVE-2022-43927: IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due
IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671.
nvd
CVE-2022-43929HIGHCVSS 7.5v11.1v11.52023-02-17
CVE-2022-43929 [HIGH] CWE-20 CVE-2022-43929:
IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when exe
IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID: 241676.
nvd
CVE-2022-41296HIGHCVSS 8.8v3.5v4.0+1 more2022-12-12
CVE-2022-41296 [HIGH] CWE-352 CVE-2022-41296: IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker
IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.
nvd
CVE-2022-35637MEDIUMCVSS 6.5v10.5v11.1+1 more2022-09-13
CVE-2022-35637 [MEDIUM] CVE-2022-35637: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of ser
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823.
nvd
CVE-2022-22483MEDIUMCVSS 6.5v9.7.0.0v10.1+3 more2022-09-13
CVE-2022-22483 [MEDIUM] CWE-269 CVE-2022-22483: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. IBM X-Force ID: 225979.
nvd
CVE-2022-22390HIGHCVSS 7.5v9.7v10.1+3 more2022-06-24
CVE-2022-22390 [HIGH] CWE-269 CVE-2022-22390: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an informat
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973.
nvd
CVE-2022-22389MEDIUMCVSS 6.5v9.7v10.1+3 more2022-06-24
CVE-2022-22389 [MEDIUM] CWE-89 CVE-2022-22389: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of ser
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing specially crafted SQL statements by an authenticated user. IBM X-Force ID: 2219740.
nvd
CVE-2021-20373HIGHCVSS 7.5v9.7v10.1+3 more2021-12-09
CVE-2021-20373 [HIGH] CVE-2021-20373: IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using th
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521.
nvd
CVE-2021-39002HIGHCVSS 7.5v9.7v10.1+3 more2021-12-09
CVE-2021-39002 [HIGH] CWE-327 CVE-2021-39002: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 us
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
nvd
CVE-2021-29678HIGHCVSS 8.7v9.7v10.1+3 more2021-12-09
CVE-2021-29678 [HIGH] CWE-863 CVE-2021-29678: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 co
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modify files. IBM X-Force ID: 199914.
nvd
CVE-2021-38926MEDIUMCVSS 5.5v9.7v10.1+3 more2021-12-09
CVE-2021-38926 [MEDIUM] CVE-2021-38926: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 co
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 210321.
nvd
CVE-2021-38931MEDIUMCVSS 6.5v11.1v11.52021-12-09
CVE-2021-38931 [MEDIUM] CWE-668 CVE-2021-38931: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not authorized to select from. IBM X-Force ID: 210418.
nvd
CVE-2021-29825HIGHCVSS 7.5v11.1v11.52021-09-16
CVE-2021-29825 [HIGH] CVE-2021-29825: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive informati
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.
nvd
CVE-2021-29763MEDIUMCVSS 5.1v11.1v11.52021-09-16
CVE-2021-29763 [MEDIUM] CWE-770 CVE-2021-29763: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267.
nvd