DeutschShown in its original language — a full translation is planned for a future version.
IBM DB2: Mehrere Schwachstellen
view advisory published 2025-01-01
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
01
describes (35)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-47554US | — | — | ||
Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing m… | ||||
| CVE-2024-47220US | — | — | ||
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: n… | ||||
| CVE-2024-45590US | high7.5 | Exploit | ||
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted pay… | ||||
| CVE-2024-45296US | — | — | ||
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Bec… | ||||
| CVE-2024-6119US | high7.5 | — | ||
Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal… | ||||
| CVE-2024-45491US | critical9.8 | — | ||
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | ||||
| CVE-2024-39338US | high7.5 | — | ||
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. | ||||
| CVE-2024-41946US | high7.5 | — | ||
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.… | ||||
| CVE-2024-41123US | high7.5 | — | ||
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]`… | ||||
| CVE-2024-41110US | —OT elevated | Exploit | ||
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow a… | ||||
| CVE-2024-6345US | — | — | ||
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to… | ||||
| CVE-2024-37371US | critical9.1 | — | ||
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. | ||||
| CVE-2024-37370US | high7.5OT elevated | — | ||
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear trun… | ||||
| CVE-2024-37890US | — | — | ||
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. T… | ||||
| CVE-2024-4068US | — | — | ||
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious u… | ||||
| CVE-2024-29857US | — | — | ||
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. I… | ||||
| CVE-2024-27281US | — | — | ||
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object in… | ||||
| CVE-2024-33599US | — | — | ||
nscd: Stack-based buffer overflow in netgroup cache
If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted
by client requests then a subsequent client request for… | ||||
| CVE-2024-33883US | — | Exploit | ||
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. | ||||
| CVE-2024-2961US | — | Exploit | ||
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT charac… | ||||
showing 20 of 35
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-73519 vom 2026-10-09external
- Red Hat Security Advisory RHSA-2025:1227 vom 2025-02-12external
- Atlassian Security Bulletin - November 18 2025external
- WID-SEC-W-2025-0001 - CSAF Versionself
- WID-SEC-2025-0001 - Portal Versionself
- IBM Security Bulletin vom 2025-01-01external
- IBM Security Bulletin 7180361 vom 2025-01-07external
- IBM Security Bulletin 7183676 vom 2025-02-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan