Design/Logic Flaw

IBM Lotus Notes 5.x through 7.0.2 allows user-assisted remote authenticated administrators to obtain a cleartext notes.id password by setting the notes.ini 1 KFMShowEntropy and 2 DebugOutfile debug variables, a different vulnerability than CVE-2005-2696...

CVE-2007-4309

CVE-2007-4309 affects IBM Lotus Notes 5.x through 7.0.2. The description states that user‑assisted remote authenticated administrators can obtain a cleartext notes.id password by setting notes.ini (1) KFM_ShowEntropy and (2) Debug_Outfile, making this a vulnerability separate from CVE-2005-2696. ...

CVE-2007-4309

IBM Lotus Notes 5.x through 7.0.2 allows user-assisted remote authenticated administrators to obtain a cleartext notes.id password by setting the notes.ini 1 KFMShowEntropy and 2 DebugOutfile debug variables, a different vulnerability than CVE-2005-2696...

IBM Lotus Notes information leak

Administrator can enable debugging function to log all user's passwords...

[Full-disclosure] heise Security: Password exposure in Lotus Notes

Excerpt from: http://www.heise-security.co.uk/news/92958 ------ Password exposure in Lotus Notes A debug function in version 5 and up of Lotus Notes can be used to write a file containing the new password in plain text when a user password is changed. This function has been designed to bring more...

Cross site scripting

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

CVE-2007-1941

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

CVE-2007-1941

CVE-2007-1941 describes a Cross-site scripting (XSS) vulnerability in the Active Content Filter feature of Domino Web Access (DWA) in IBM Lotus Notes. Affected software: IBM Lotus Domino with DWA before 6.5.6 and 7.x before 7.0.2 FP1. The issue allows remote attackers to inject arbitrary web scri...

CVE-2007-1784

The JNILoader ActiveX control STJNILoader.ocx 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary arguments to the loadLibrary function...

Code injection

The JNILoader ActiveX control STJNILoader.ocx 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary arguments to the loadLibrary function...

CVE-2007-1784

The CVE-2007-1784 entry affects IBM Lotus Notes Sametime (JNILoader ActiveX: STJNILoader.ocx, version 3.1.0.26) where remote attackers can cause arbitrary code execution by passing arbitrary arguments to the loadLibrary function, enabling loading of arbitrary DLLs. Impact is described as remote c...

CVE-2007-1784

The JNILoader ActiveX control STJNILoader.ocx 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary arguments to the loadLibrary function...

CVE-2006-5835

The Notes Remote Procedure Call NRPC protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file...

CVE-2006-5835

The Notes Remote Procedure Call NRPC protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file...

CVE-2006-5835

IBM Lotus Notes Domino NRPC allows unauthenticated user lookups, enabling remote attackers to obtain user ID files. Affected: Domino before 6.5.5 FP2 and 7.x before 7.0.2. Impact: potential disclosure of user IDs. Remediation: upgrade to 6.5.5 FP2+ or 7.0.2+. OpenVAS/NT-based tooling references i...

[Full-disclosure] Lotus Notes pre-login User.ID key leak

Hello, We have coordinated a vuln disclosure with IBM Lotus Notes security for today, relating to an info leak issue with Lotus Notes where it is possible to: 1. Retrieve User.ID keyfiles, without entering a valid passphrase as is normally required 2. Validate existing Lotus Notes users login nam...

Lotus Notes information leak

It's possible to check user existance and download certificate of new user with TCP/1352 port protocol...

Fenestrae Faxination Server远程代码执行漏洞

Fenestrae Faxination Server是应用于Microsoft Exchange和Lotus Notes的传真服务器解决方案。 Fenestrae Faxination Server对用户请求的处理上存在漏洞，远程用户可以通过发送特制的报文导致在Faxination服务器上以本地系统权限执行任意命令。 Fenestrae Faxination Server 6.0 Fenestrae Faxination Server 5.0 Fenestrae Faxination Server 4.0...

IBM Lotus Notes本地不安全默认目录权限漏洞

Lotus Domino/Notes服务器是一款基于WEB协同工作的应用程序架构，运行在Linux/Unix和Microsoft Windows操作系统平台下。 Lotus Notes对文件访问的权限控制上存在漏洞，本地攻击者可能利用此漏洞非授权访问文件。 Lotus Notes对notes目录及其所有子对象设置了不安全的默认权限，对Everyone组分配了Full Control权限，这允许本地攻击者能够删除、操控和替换应用程序的任何文件。 IBM Lotus Notes 7.0.1 IBM Lotus Notes 7.0 IBM Lotus Notes 6.5.5 IBM Lotus...

InnerMedia DUNZIP32.dll远程栈溢出漏洞

DUNZIP32.dll是一个流行的第三方压缩媒体库。 很多应用程序都用到了DUNZIP32.dll做为压缩库。DUNZIP32.dll在解压有超长用户名的压缩文件时存在栈溢出漏洞，可能允许攻击者在用户系统上执行任意代码。 0 McAfee VirusScan 10.x Real Networks RealPlayer 10.5 Real Networks RealPlayer 10 Real Networks RealOne Player 2.0 IBM Lotus Notes = 5.0.10 IBM Lotus Notes 6.5.4 McAfee SecurityCenter 6...