CVE-2025-33012

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS probability

0.16%

CWE

CWE-324

Published

2025-11-07

Last modified

2026-03-13

Affected products

• IBM Db2
• IBM Db2
• IBM Db2
• IBM Db2

Weakness type

• CWE-324

Related vulnerabilities

• CVE-2026-39923 — Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
• CVE-2026-54787 — sigstore-go fails to check signature timestamps against a signing key's validity period
• CVE-2026-52809 — Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
• CVE-2025-48813 — Virtual Secure Mode Spoofing Vulnerability
• CVE-2023-5342 — Shim: expired secure boot certificate
• CVE-2025-2291 — PgBouncer default auth_query does not take Postgres password expiry into account
• CVE-2025-31123 — Zitadel Expired JWT Keys Usable for Authorization Grants
• CVE-2024-7318 — Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

Markdown version · Browse all CVEs