rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-36375 IBM DataPower Gateway vulnerable to CSRF
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: DataPower Gateway 10.6CD
cpes: cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_106cd:10.6.5.0:*:*:*:*:*:*:*
vendor: IBM
product: DataPower Gateway 10.5.0
cpes: cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1050:10.5.0.20:*:*:*:*:*:*:*
vendor: IBM
product: DataPower Gateway 10.6.0
cpes: cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datapower_gateway_1060:10.6.0.8:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Credits: lang: en
value: Acknowledgement This vulnerability was reported to IBM by Maciej Włodarczyk & Michał Bartoszuk @ STM Cyber.
Published: 2026-04-01T22:50:51.697Z
CVE-2025-36376 IBM Security QRadar EDR Software has multiple vulnerabilities
IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate another user on the system.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Security QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_qradar_edr:3.12.23:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-02-17T20:37:28.659Z
CVE-2025-36377 IBM Security QRadar EDR Software has multiple vulnerabilities
IBM Security QRadar EDR 3.12 through 3.12.23 does not invalidate session after a session expiration which could allow an authenticated user to impersonate another user on the system.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Security QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_qradar_edr:3.12.23:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-02-17T20:32:01.299Z
CVE-2025-36379 IBM Security QRadar EDR Software has multiple vulnerabilities
IBM Security QRadar EDR 3.12 through 3.12.23 IBM Security ReaQta uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: IBM
product: Security QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_qradar_edr:3.12.23:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-02-17T20:30:29.415Z
CVE-2025-36384 IBM Db2 Privilege Escalation
IBM Db2 for Windows 12.1.0 - 12.1.3  could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-30T21:27:48.473Z
CVE-2025-36386 There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics
IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: IBM
product: IBM Maximo Application Suite
cpes: cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-28T15:56:58.740Z
CVE-2025-36387 IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:27:45.304Z
CVE-2025-36396 Security vulnerabilities have been found in IBM Application Gateway
IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Application Gateway
cpes: cpe:2.3:a:ibm:application_gateway:23.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:23.10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:25.09:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:25.09.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-01-20T15:22:11.780Z
CVE-2025-36397 Security vulnerabilities have been found in IBM Application Gateway
IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: IBM
product: Application Gateway
cpes: cpe:2.3:a:ibm:application_gateway:23.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:23.10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:25.09:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:25.09.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-01-20T15:23:30.652Z
CVE-2025-36407 IBM Db2 Denial of Service
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:27:41.983Z
CVE-2025-36408 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: ApplinX
cpes: cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-01-20T15:33:59.216Z
CVE-2025-36409 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: ApplinX
cpes: cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-01-20T15:37:56.120Z
CVE-2025-36410 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: IBM
product: ApplinX
cpes: cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-01-20T15:39:53.965Z
CVE-2025-36411 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: ApplinX
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-01-20T15:43:07.492Z
CVE-2025-36418 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: IBM
product: ApplinX
cpes: cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-01-20T15:50:40.562Z
CVE-2025-36419 Multiple vulnerabilities found in IBM ApplinX.
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.
Problem types: cwe_id: CWE-550
description: CWE-550 Server-generated Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: ApplinX
cpes: cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2026-01-20T15:53:37.574Z
CVE-2025-36422 IBM InfoSphere Information Server is vulnerable to cross-site request forgery
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:infosphere_information_server:11.7.1.6:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Published: 2026-03-25T20:26:58.168Z
CVE-2025-36423 IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:27:38.081Z
CVE-2025-36424 IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:27:34.569Z
CVE-2025-36425 IBM Db2 Information Disclosure
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration.
Problem types: cwe_id: CWE-256
description: CWE-256
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-02-17T17:13:03.635Z
CVE-2025-36427 IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:27:31.388Z