High WID-SEC-2022-0909 8 CVEs

IBM DB2: Mehrere Schwachstellen ermöglichen Codeausführung

Published Aug 3, 2022 · Updated Aug 9, 2026 · Revision 4 · de-DE

Vendor: IBM Vendor: Red Hat Product: Db2 Product: Enterprise Linux Product: Operational Decision Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 8

Critical 9.8

CVE-2021-44906 Public exploit

Prototype Pollution in minimist

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

js-jquery node-minimist minimist node-minimist Debian Ubuntu Azure Linux npm

Mar 17, 2022
Critical 9.8

CVE-2022-29078 Public exploit Scanner template EPSS 33%

ejs template injection vulnerability

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …

node-ejs ejs node-ejs Debian Ubuntu npm

Apr 25, 2022
High 7.8

CVE-2021-43138

Prototype Pollution in async

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

async npm

Apr 6, 2022
High 7.7

CVE-2022-25647 EPSS 12%

Deserialization of Untrusted Data

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven

May 1, 2022
High 7.5

CVE-2022-28948

gopkg.in/yaml.v3 Denial of Service

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

dynamic-localpv-provisioner thanos-operator snapd thanos-operator-compat Debian Ubuntu Azure Linux Alpine Wolfi Go

May 19, 2022
High 7.3

CVE-2020-7774 EPSS 70%

Prototype Pollution

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

nodejs y18n node-y18n node-y18n Debian Ubuntu Alpine npm

Nov 17, 2020
Medium 5.3

CVE-2022-33987

Got allows a redirect to a UNIX socket

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

node-got node-got got Debian Ubuntu npm

Jun 18, 2022
Low 2.6

CVE-2022-0536

Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

follow-redirects follow-redirects/follow-redirects js-jquery node-follow-redirects Debian Ubuntu Azure Linux npm

Feb 9, 2022

Revision history

2026-08-09 #4
Neue Updates von IBM aufgenommen
2025-03-30 #3
Neue Updates von IBM aufgenommen
2022-09-08 #2
Neue Updates von Red Hat aufgenommen
2022-08-03 #1
Initiale Fassung

References

IBM Security Bulletin: 6610082 vom 2022-08-03
https://www.ibm.com/support/pages/node/6610082
Red Hat Security Advisory RHSA-2022:6389 vom 2022-09-08
https://access.redhat.com/errata/RHSA-2022:6389
IBM Security Bulletin 7229443 vom 2025-03-28
https://www.ibm.com/support/pages/node/7229443
IBM Security Bulletin 7283059 vom 2026-08-10
https://www.ibm.com/support/pages/node/7283059