Veille CVE

Recherche « IBM Db2 »

72 CVE

Critique 9 Élevée 23 Moyenne 35 Faible 5 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM Db2 » ✕
  1. CVE-2026-109839 3.1 Faible

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

  2. CVE-2026-109838 5.1 Moyenne

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

  3. CVE-2026-65198 8.6 Élevée

    Huawei openUBMC

    Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

  4. CVE-2026-96012 9.9 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

  5. CVE-2026-104364 3.3 Faible

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

  6. CVE-2026-104332 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

  7. CVE-2025-27902 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

  8. CVE-2025-27897 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  9. CVE-2025-27896 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  10. CVE-2025-27895 6.1 Moyenne

    IBM DB2 Recovery Expert for Linux, UNIX and Windows

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  11. CVE-2026-78404 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

  12. CVE-2026-18166 7.7 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

  13. CVE-2026-105466 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

  14. CVE-2026-105465 8.8 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

  15. CVE-2026-105464 8.8 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

  16. CVE-2026-18104 3.3 Faible

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.

  17. CVE-2026-17463 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

  18. CVE-2026-17047 5.4 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.

  19. CVE-2026-16702 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.

  20. CVE-2026-15955 7.5 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

  21. CVE-2026-87958 8.1 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

  22. CVE-2026-86093 7.5 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

  23. CVE-2026-86087 4.3 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

  24. CVE-2026-17483 3.3 Faible

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

  25. CVE-2026-16660 5.3 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

  26. CVE-2026-18567 4.7 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.

  27. CVE-2026-18554 7.5 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

  28. CVE-2026-18178 8.1 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

  29. CVE-2026-17227 6.5 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command.

  30. CVE-2026-17209 5.4 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

  31. CVE-2026-17186 9.8 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

  32. CVE-2026-17184 9.8 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

  33. CVE-2026-17182 9.8 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

  34. CVE-2026-17181 8.6 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

  35. CVE-2026-17179 6.5 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

  36. CVE-2026-17177 7.5 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

  37. CVE-2026-17175 6.5 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

  38. CVE-2026-17173 6.5 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.

  39. CVE-2026-17081 7.5 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory.

  40. CVE-2026-17079 4.3 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter.

  41. CVE-2026-16915 7.5 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

  42. CVE-2026-16905 6.5 Moyenne

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

  43. CVE-2026-16879 8.8 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.

  44. CVE-2026-16708 7.5 Élevée

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

  45. CVE-2026-10534 9.8 Critique

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

  46. CVE-2026-18097 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

  47. CVE-2026-18096 3.3 Faible

    IBM Db2

    IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

  48. CVE-2026-16480 7.1 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

  49. CVE-2026-10543 9.8 Critique

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

  50. CVE-2026-16956 9.8 Critique

    IBM Db2 Mirror for i

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  51. CVE-2026-10695 5.5 Moyenne

    IBM Db2

    IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.

  52. CVE-2026-10535 7.8 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

  53. CVE-2026-7771 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.

  54. CVE-2026-14501 9.8 Critique

    IBM Db2 Genius Hub · IBM Agentics

    IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.

  55. CVE-2026-9762 7.8 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

  56. CVE-2026-11906 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.

  57. CVE-2026-10109 9.8 Critique

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

  58. CVE-2025-36372 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

  59. CVE-2023-33854 5.3 Moyenne

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data · Ibm db2 · Ibm db2 warehouse

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques.

  60. CVE-2025-2669 6.5 Moyenne

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data · Ibm db2 · Ibm db2 warehouse

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.

  61. CVE-2024-54178 6.5 Moyenne

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data · Ibm db2 · Ibm db2 warehouse

    IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources.

  62. CVE-2026-6938 7.5 Élevée

    IBM Db2

    IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query.

  63. CVE-2026-6053 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables.

  64. CVE-2026-6052 7.5 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

  65. CVE-2026-6051 7.5 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.

  66. CVE-2026-3676 6.5 Moyenne

    IBM Cloud APM, Base Private · IBM Cloud APM, Advanced Private · Ibm cloud application performance managemen

    IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of the Fenced environment.

  67. CVE-2026-1718 7.5 Élevée

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled.

  68. CVE-2025-13755 5.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

  69. CVE-2026-8654 8.7 Élevée

    Delphix Continuous data IBM Db2 Connector · Delphix Continuous data MangoDB Connector · Delphix Continuous data PostgreSQL Connector · Delphix Continuous data MySQL Connector

    Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

  70. CVE-2026-1577 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

  71. CVE-2025-36122 6.5 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service using a specially crafted SQL query due to improper allocation of system resources.

  72. CVE-2025-14688 5.3 Moyenne

    IBM Db2

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certain configurations exist.