KLA10200 CI vulnerability in IBM

An XSS vulnerability was found in IBM products. By exploiting this vulnerability malicious users can inject web script. This vulnerability can be exploited remotely via a specially designed e-mail. Original advisories - Exploitation Related products IBM-Notes IBM-Domino CVE list CVE-2014-0913...

CVE-2014-0892

CVE-2014-0892 affects IBM Notes and Domino on Linux x86 (32-bit). The root cause is incorrect GCC options causing absence of NX protection, enabling a remote attacker to place crafted x86 code on the stack and execute arbitrary code. Affected versions: IBM Notes/Domino 8.5.x before 8.5.3 FP6 IF3 ...

CVE-2014-0892: Exposure of Sensitive Information to an Unauthorized Actor

IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by leveraging the absence of the NX protection mechanism and placing crafted x86 code on the stack, ak...

IBM Notes and Domino on x86 Linux specify an executable stack

Overview IBM Notes and Domino on x86 Linux are incorrectly built requesting an executable stack. This can make it easier for attackers to exploit vulnerabilities in Notes, Domino, and any of the child processes that they may spawn. Description The build environment for the x86 Linux versions of I...

IBM Notes 8.5.x < 8.5.3 FP5 Multiple Vulnerabilities

The remote host has a version of IBM Notes formerly Lotus Notes 8.5.x prior to 8.5.3 Fix Pack 5 installed. It is, therefore, reportedly affected by the following vulnerabilities : - The included version of the IBM Java SDK contains a version of the IBM JRE that contains numerous security issues...

IBM Notes PNG Image Parsing Integer Overflow (CVE-2013-2977)

A code execution vulnerability has been reported in IBM Notes formerly Lotus Notes. The vulnerability is due to an integer overflow while parsing PNG images. A remote unauthenticated attacker can exploit this vulnerability by enticing the target user to view a malicious email. Successful...

CVE-2012-6349

Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka SPR KLYH92XL3W...

Buffer overflow

Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka SPR KLYH92XL3W...

CVE-2012-6349

Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka SPR KLYH92XL3W...

CVE-2012-6349

CVE-2012-6349 describes a buffer overflow in the Autonomy KeyView IDOL .mdb parser, used in IBM Notes 8.5.x before 8.5.3 FP4 . A crafted file can trigger the overflow, enabling remote code execution. The vulnerability is tied to the KeyView IDOL integration (via the .mdb parser) and is consistent...

CVE-2012-6349: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka SPR KLYH92XL3W...

CVE-2013-0536

ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J2...

Code injection

ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J2...

CVE-2013-0536

IBM Notes 8.x/9.0 vulnerable to local privilege escalation via ntmulti.exe in the Multi-User Profile Cleanup service. Affected: Notes 8.0–8.5.x before FP5 and 9.0 before IF2; root cause is a code execution path during the next login of a different user. Impact: local privilege compromise (C/C/I/A...

CVE-2013-0536

ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J2...

CVE-2013-0536: Undefined Security Weakness

ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J2...

IBM Notes PNG Integer Overflow

The IBM Notes application installed on the remote Windows host is 8.5 earlier than Fix Pack 4 Interim Fix 1, or 9.0 earlier than Interim Fix 1. It is, therefore, potentially affected by an integer overflow vulnerability. By exploiting this flaw, a remote, unauthenticated attacker could execute...

IBM Notes Single Sign On Password Disclosure

The version of IBM Notes installed on the remote Windows host uses the built-in Single Sign On feature for authentication. Single Sign On is affected by a vulnerability wherein malicious code planted on a user's workstation can be used to reveal the password of an authenticated user. C Tenable...

IBM Notes Accepts JavaScript Tags Inside HTML Emails

The IBM Notes application installed on the remote Windows host accepts Java applet tags and JavaScript tags inside HTML emails, making it possible to load Java applets and scripts from a remote location. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66637;...

CVE-2013-2977

Integer overflow in IBM Notes 8.5.x before 8.5.3 FP4 Interim Fix 1 and 9.x before 9.0 Interim Fix 1 on Windows, and 8.5.x before 8.5.3 FP5 and 9.x before 9.0.1 on Linux, allows remote attackers to execute arbitrary code via a malformed PNG image in a previewed e-mail message, aka SPR NPEI96K82Q...