4

CVE-2014-8910

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Db2 Version 9.7 SwEdition advanced_enterprise
Ibm ≫ Db2 Version 9.7 SwEdition advanced_workgroup
Ibm ≫ Db2 Version 9.7 SwEdition enterprise
Ibm ≫ Db2 Version 9.7 SwEdition express
Ibm ≫ Db2 Version 9.7 SwEdition workgroup
Ibm ≫ Db2 Version 9.8 SwEdition advanced_enterprise
Ibm ≫ Db2 Version 9.8 SwEdition advanced_workgroup
Ibm ≫ Db2 Version 9.8 SwEdition enterprise
Ibm ≫ Db2 Version 9.8 SwEdition express
Ibm ≫ Db2 Version 9.8 SwEdition workgroup
Ibm ≫ Db2 Version 10.1 SwEdition advanced_enterprise
Ibm ≫ Db2 Version 10.1 SwEdition advanced_workgroup
Ibm ≫ Db2 Version 10.1 SwEdition enterprise
Ibm ≫ Db2 Version 10.1 SwEdition express
Ibm ≫ Db2 Version 10.1 SwEdition workgroup
Ibm ≫ Db2 Version 10.5 SwEdition advanced_enterprise
Ibm ≫ Db2 Version 10.5 SwEdition advanced_workgroup
Ibm ≫ Db2 Version 10.5 SwEdition enterprise
Ibm ≫ Db2 Version 10.5 SwEdition express
Ibm ≫ Db2 Version 10.5 SwEdition workgroup
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.86% 0.764
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

http://www-01.ibm.com/support/docview.wss?uid=swg1IT06353
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06354
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06355
http://www-01.ibm.com/support/docview.wss?uid=swg1IT06356
http://www-01.ibm.com/support/docview.wss?uid=swg21697988
Patch
Vendor Advisory
http://www.securityfocus.com/bid/75949
http://www.securitytracker.com/id/1032883