CVE-2025-36131: fallo de gravedad media en IBM Db2
IBM Db2 information disclosure
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.6epss 0.2%
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
IBM · Db2CVEs relacionadas — IBM Db2
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-10109CRITICALIBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handlingEPSS 0.9%CVE-2026-15955HIGHIBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsEPSS 0.5%CVE-2026-86093HIGHIBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditionsEPSS 0.5%CVE-2026-16702MEDIUMIBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereferenceEPSS 0.5%CVE-2026-17463MEDIUMIBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumptionEPSS 0.5%CVE-2026-11906MEDIUMIBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated userEPSS 0.4%