IBM Domino 8.5.x < 8.5.3 FP6 iNotes Multiple XSS (uncredentialed check)

According to its banner, the version of IBM Domino formerly IBM Lotus Domino on the remote host is 8.5.x prior to 8.5.3 FP6. It is, therefore, affected by the following iNotes-related cross-site scripting vulnerabilities : - An input validation error exists related to handling content in email...

IBM Domino 8.5.x < 8.5.3 FP6 iNotes Multiple XSS (credentialed check)

The remote host has a version of IBM Domino formerly Lotus Domino 8.5.x prior to 8.5.3 Fix Pack 6 installed. It is, therefore, reportedly affected by the following iNotes-related cross-site scripting vulnerabilities : - An input validation error exists related to handling content in email message...

CVE-2013-2629

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

Authorization

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-2629

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-2629

Leed (Light Feed) before 1.5 Stable is affected by CVE-2013-2629 through an authentication bypass in action.php, enabling remote attackers to access functions such as importForm, importFeed, addFavorite, and removeFavorite without proper user verification. The issue is part of a set of vulnerabil...

CVE-2013-2629: Improper Input Validation

Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to bypass authorization via vectors related to the 1 importForm, 2 importFeed, 3 addFavorite, or 4 removeFavorite actions in action.php...

CVE-2013-4065

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...

Cross site scripting

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...

CVE-2013-4065

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...

CVE-2013-2628

Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...

Sql injection

SQL injection vulnerability in action.php in Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action...

CVE-2013-2628

Multiple cross-site request forgery CSRF vulnerabilities in action.php in Leed Light Feed, possibly before 1.5 Stable, allow remote attackers to hijack the authentication of administrators for unspecified requests, related to the lack of an anti-CSRF token...

CVE-2013-2627

CVE-2013-2627 describes a SQL injection in Leed (Light Feed) through action.php?action=removeFolder&id=... where user input is not properly escaped. The CSNC advisory confirms multiple vulnerabilities in Leed, including this SQL injection, and notes the vendor-provided fix was to upgrade to the l...

PT-2013-4826

Name of the Vulnerable Software and Affected Versions IBM Domino versions 8.5.x through 8.5.3 FP5 IBM Domino versions 9.0.x through 9.0.0 Description A cross-site scripting XSS issue exists when ultra-light mode is enabled, allowing remote authenticated users to inject arbitrary web script or HTM...

PT-2013-4827

Name of the Vulnerable Software and Affected Versions IBM Domino versions 8.5.x through 8.5.3 FP5 and 9.0.x through 9.0.0 Description A cross-site scripting XSS issue exists when ultra-light mode is enabled, allowing remote attackers to inject arbitrary web script or HTML via active content in an...

PT-2013-3858

Name of the Vulnerable Software and Affected Versions Leed Light Feed versions prior to 1.5 Stable Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in a "removeFolder" action in the "action.php" file. Recommendations For versio...

CVE-2013-4065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP...

CVE-2013-4064: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN9ARMFA...

CVE-2013-2627: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in action.php in Leed Light Feed, possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action...