DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM DB2: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2020-04-23
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen
01
beschreibt (28)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-17571US | critical9.8 | Exploit | ||
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a… | ||||
| CVE-2017-18640US | high7.5 | — | ||
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. | ||||
| CVE-2019-10172US | high7.5 | Exploit | ||
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libr… | ||||
| CVE-2019-17195US | critical9.8 | Exploit | ||
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a… | ||||
| CVE-2019-10202US | critical9.8 | — | ||
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968… | ||||
| CVE-2019-16869US | high7.5 | — | ||
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. | ||||
| CVE-2019-12402US | high7.5 | — | ||
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a… | ||||
| CVE-2019-10086US | high7.3 | — | ||
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… | ||||
| CVE-2019-9518US | high7.5 | — | ||
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and w… | ||||
| CVE-2019-9515US | high7.5 | — | ||
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RF… | ||||
| CVE-2019-9514US | high7.5 | — | ||
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over ea… | ||||
| CVE-2019-9512US | high7.5 | — | ||
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to bui… | ||||
| CVE-2019-0201US | medium5.9OT erhöht | — | ||
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requ… | ||||
| CVE-2018-8009US | high8.8 | — | ||
Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that acce… | ||||
| CVE-2018-11771US | medium5.5 | — | ||
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the… | ||||
| CVE-2018-8012US | high7.5OT erhöht | — | ||
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary… | ||||
| CVE-2018-10237US | medium5.9 | — | ||
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library… | ||||
| CVE-2015-2156US | high7.5 | — | ||
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to by… | ||||
| CVE-2017-5637US | high7.5OT hoch | Exploit | ||
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve… | ||||
| CVE-2017-12974US | high7.5 | — | ||
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an I… | ||||
20 von 28 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2020:2603 vom 2020-06-17external
- Red Hat Security Advisory RHSA-2020:4807 vom 2020-11-04external
- Red Hat Security Advisory RHSA-2021:3225 vom 2021-08-20external
- WID-SEC-W-2022-0770 - CSAF Versionself
- WID-SEC-2022-0770 - Portal Versionself
- Dell Security Advisory DSA-2024-070 vom 2024-02-03external
- Hitachi Vulnerability Information HITACHI-SEC-2022-115 vom 2022-05-27external
- Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan