Db2 Recovery Expert For Linux Unix And Windows
Monthly
Reflected cross-site scripting in IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 lets an unauthenticated attacker inject arbitrary JavaScript into the product's Web UI, which then executes in the browser of a logged-in user within a trusted session and can lead to credential or session disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) shows the attacker does not need to authenticate, but a victim with an active session must be induced to trigger the reflected payload, making user interaction the primary limiting factor and the practical risk moderate-to-low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available (CWE-79).
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 allows an unauthenticated attacker to embed arbitrary JavaScript in the Web UI, which executes in the browser of a victim operator who interacts with the crafted content and can lead to disclosure of credentials from a trusted session. The flaw is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no attacker authentication is needed but the payload only fires after a legitimate user opens or interacts with the injected content, so this is not a drive-by, self-propagating compromise. Exploitation status is assessed as no public exploit identified at time of analysis, with no CISA KEV listing; the practical exposure is limited by the mandatory user interaction, the narrow deployment base of this recovery tooling, and the fact that only the specific 5.5 IF 2 build is in scope.
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 Web UI allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's trusted session, potentially leading to credential disclosure. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit was identified at time of analysis. A vendor patch is available, and successful exploitation requires a logged-in operator to interact with attacker-supplied input.
Untrusted external web-link handling in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 Interim Fix 2 allows a remote, unauthenticated attacker to craft a link that can expose sensitive information or trigger unauthorized actions inside a victim's browser (CWE-1022). The flaw cannot be triggered server-side or automatically: it requires the victim to click an attacker-supplied link that resolves through the application's untrusted external reference, so the practical barrier is social engineering rather than authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1). Impact is confined to the victim's browser context rather than the Db2 Recovery Expert host, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Reflected cross-site scripting in IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 lets an unauthenticated attacker inject arbitrary JavaScript into the product's Web UI, which then executes in the browser of a logged-in user within a trusted session and can lead to credential or session disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) shows the attacker does not need to authenticate, but a victim with an active session must be induced to trigger the reflected payload, making user interaction the primary limiting factor and the practical risk moderate-to-low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available (CWE-79).
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 allows an unauthenticated attacker to embed arbitrary JavaScript in the Web UI, which executes in the browser of a victim operator who interacts with the crafted content and can lead to disclosure of credentials from a trusted session. The flaw is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no attacker authentication is needed but the payload only fires after a legitimate user opens or interacts with the injected content, so this is not a drive-by, self-propagating compromise. Exploitation status is assessed as no public exploit identified at time of analysis, with no CISA KEV listing; the practical exposure is limited by the mandatory user interaction, the narrow deployment base of this recovery tooling, and the fact that only the specific 5.5 IF 2 build is in scope.
Reflected cross-site scripting in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 Web UI allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's trusted session, potentially leading to credential disclosure. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); no public exploit was identified at time of analysis. A vendor patch is available, and successful exploitation requires a logged-in operator to interact with attacker-supplied input.
Untrusted external web-link handling in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 Interim Fix 2 allows a remote, unauthenticated attacker to craft a link that can expose sensitive information or trigger unauthorized actions inside a victim's browser (CWE-1022). The flaw cannot be triggered server-side or automatically: it requires the victim to click an attacker-supplied link that resolves through the application's untrusted external reference, so the practical barrier is social engineering rather than authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1). Impact is confined to the victim's browser context rather than the Db2 Recovery Expert host, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.