Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action...

Cross site scripting

Cross-site scripting XSS vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter, a different vulnerability than CVE-2012-4824 and CVE-2012-4825...

Open redirect

Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter...

CVE-2012-5308

Cross-site request forgery CSRF vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote attackers to hijack the authentication of arbitrary users for requests that create problem reports via a getReportProblem upload action...

CVE-2012-4825

CVE-2012-4825 affects IBM Lotus Notes Traveler before 8.5.3.2. The vulnerability lies in the servlet/traveler/ILNT.mobileconfig component, where an attacker can inject arbitrary web script or HTML via the (1) userId or (2) address parameter in a getClientConfigFile action, resulting in cross-site...

CVE-2012-5309

The vulnerability CVE-2012-5309 affects IBM Lotus Notes Traveler up to 8.5.3.3 Interim Fix 1. The issue is in the servlet/traveler component, which does not properly restrict invalid authentication attempts, enabling easier remote brute-force access. Impact is described as partial confidentiality...

CVE-2012-4824

CVE-2012-4824: Open redirect in IBM Lotus Notes Traveler 8.5.3 prior to 8.5.3.3 Interim Fix 1; a remote attacker can cause user navigation to an arbitrary site via redirectURL in servlet/traveler. Impact: phishing risk; no exploitation details provided. Mitigation: apply IBM 8.5.3.3 Interim Fix 1...

CVE-2012-5309

servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 does not properly restrict invalid authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2012-5307

Cross-site scripting XSS vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter, a different vulnerability than CVE-2012-4824 and CVE-2012-4825...

CVE-2012-4824

Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectURL parameter...

CVE-2012-4825

Multiple cross-site scripting XSS vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 userId or 2 address parameter in a getClientConfigFile action...

CVE-2012-5307

CVE-2012-5307 is described as a cross-site scripting (XSS) vulnerability in IBM Lotus Notes Traveler’s servlet/traveler code. The advisory specifies that when Firefox is used, attackers can inject arbitrary web script or HTML via the redirectURL parameter. This is a distinct issue from CVE-2012-4...

CVE-2012-5308

The CVE-2012-5308 entry concerns IBM Lotus Notes Traveler (servlet/traveler) with a CSRF vulnerability that, through to version 8.5.3.3 Interim Fix 1, allows remote attackers to hijack the authentication of arbitrary users via requests that create problem reports using a getReportProblem upload a...

IBM Lotus Notes Traveler 8.5.3 XSS / CSRF / Brute Force

Hello list! I want to warn you about Brute Force, Cross-Site Scripting, Cross-Site Request Forgery and Redirector vulnerabilities in IBM Lotus Notes Traveler. IBM are planning to release their advisory soon concerning these vulnerabilities. ------------------------- Affected products:...

IBM Lotus Notes Traveler 8.5.1.x - Multiple Input Validation Vulnerabilities

IBM Lotus Notes Traveler 8.5.1.x - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/55740/info IBM Lotus Notes Traveler is prone to a URI-redirection vulnerability, multiple HTML-injection vulnerabilities and cross-site scripting vulnerabilities because it fails...

IBM Lotus Notes Traveler 8.5.1.x - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/55740/info IBM Lotus Notes Traveler is prone to a URI-redirection vulnerability, multiple HTML-injection vulnerabilities and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically...

IBM Lotus Notes Traveler 8.5.3 XSS / CSRF / Brute Force

Exploit for hardware platform in category web applications I want to warn you about Brute Force, Cross-Site Scripting, Cross-Site Request Forgery and Redirector vulnerabilities in IBM Lotus Notes Traveler. IBM are planning to release their advisory soon concerning these vulnerabilities...

CVE-2010-5251

Multiple untrusted search path vulnerabilities in IBM Lotus Notes 8.5 allow local users to gain privileges via a Trojan horse 1 nnoteswc.dll or 2 nlsxbe.dll file in the current working directory, as demonstrated by a directory that contains a .vcf, .vcs, or .ics file. NOTE: the provenance of this...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in IBM Lotus Notes 8.5 allow local users to gain privileges via a Trojan horse 1 nnoteswc.dll or 2 nlsxbe.dll file in the current working directory, as demonstrated by a directory that contains a .vcf, .vcs, or .ics file. NOTE: the provenance of this...

CVE-2010-5251

The CVE-2010-5251 entry concerns IBM Lotus Notes 8.5 with privilege escalation via untrusted search paths. A local user can gain privileges through Trojan horse DLLs (nnoteswc.dll or nlsxbe.dll) placed in the current working directory, demonstrated by a directory containing a .vcf, .vcs, or .ics ...