CVE-2007-6706

Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP...

CVE-2007-6706

CVE-2007-6706 affects the IBM Lotus Notes client (nlnotes.dll) with versions 6.5 and 7.0.x up to 7.0.2 CCH or 7.0.3, and possibly 8.0. A crafted text payload in an e-mail message sent over SMTP could allow remote code execution. The connected records corroborate this as an unspecified vulnerabili...

CVE-2008-1217

The provided connected documents describe CVE-2007-6706 and CVE-2008-1217 as related, unspecified vulnerabilities affecting IBM Lotus Notes clients. Affected product: nlnotes.dll in the Lotus Notes client. Versions impacted include Notes 6.5, 7.0.x (before 7.0.2 CCH or 7.0.3), and 8.0.x (before 8...

CVE-2007-6706

Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH or 7.0.3, and possibly 8.0 allows remote attackers to execute arbitrary code via crafted text in an e-mail message sent over SMTP...

CVE-2008-1216

CVE-2008-1216 affects IBM Lotus Quickr 8.0 server (and possibly QuickPlace 7.x). The vulnerability arises from improper handling of URIs containing XSS attack strings in a Calendar OpenDocument action to main.nsf, where a Count parameter may carry a JavaScript event within a malformed element, en...

CVE-2008-1217

Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706...

CVE-2008-1216

IBM Lotus Quickr 8.0 server, and possibly QuickPlace 7.x, does not properly identify URIs containing cross-site scripting XSS attack strings, which allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to main.nsf with a Count parameter containing a...

IBM Quickr 8 Calendar Xss Injection (Bypass Quickr 8.0 Xss Filter)

description:Lotus Quickr, announced at Lotusphere 2007, is an evolution of Lotus QuickPlace ,The software use a weak xss filter that an attacker can bypass this xss filter. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to ...

lotusquickr-xss.txt

description:Lotus Quickr, announced at Lotusphere 2007, is an evolution of Lotus QuickPlace ,The software use a weak xss filter that an attacker can bypass this xss filter. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to ...

Cross site scripting

Cross-site scripting XSS vulnerability in leg/Main.nsf in IBM Lotus Quickplace 7.0 allows remote attackers to inject arbitrary web script or HTML via an hSearchString sub-parameter in the PreSetFields parameter of an EditDocument action...

Design/Logic Flaw

IBM Lotus Notes 6.0, 6.5, 7.0, and 8.0 signs an unsigned applet when a user forwards an email message to another user, which allows user-assisted remote attackers to bypass Execution Control List ECL protection...

CVE-2008-0861

Cross-site scripting XSS vulnerability in leg/Main.nsf in IBM Lotus Quickplace 7.0 allows remote attackers to inject arbitrary web script or HTML via an hSearchString sub-parameter in the PreSetFields parameter of an EditDocument action...

CVE-2008-0862

IBM Lotus Notes 6.0, 6.5, 7.0, and 8.0 signs an unsigned applet when a user forwards an email message to another user, which allows user-assisted remote attackers to bypass Execution Control List ECL protection...

CVE-2008-0862

IBM Lotus Notes 6.0, 6.5, 7.0, and 8.0 signs an unsigned applet when a user forwards an email message to another user, which allows user-assisted remote attackers to bypass Execution Control List ECL protection...

CVE-2008-0861

Cross-site scripting XSS vulnerability in leg/Main.nsf in IBM Lotus Quickplace 7.0 allows remote attackers to inject arbitrary web script or HTML via an hSearchString sub-parameter in the PreSetFields parameter of an EditDocument action...

CVE-2008-0862

CVE-2008-0862 affects IBM Lotus Notes 6.0, 6.5, 7.0, and 8.0. The issue arises when forwarding an email, where Notes signs an unsigned applet, potentially bypassing the Execution Control List (ECL). The NVD entry lists the impact as user-assisted remote execution with partial confidentiality impa...

CVE-2008-0861

CVE-2008-0861 describes a cross-site scripting (XSS) vulnerability in IBM Lotus Quickplace 7.0, specifically in leg/Main.nsf. An attacker can inject arbitrary web script or HTML through an h_SearchString sub-parameter inside the PreSetFields parameter of an EditDocument action. The NVD entry list...

IBM Lotus Quickr QuickPlace Server 8.0 - Calendar 'Count' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27925/info IBM Lotus Quickr is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting use...

IBM Lotus Quickr QuickPlace Server 8.0 - Calendar Count Cross-Site Scripting

IBM Lotus Quickr QuickPlace Server 8.0 - Calendar Count Cross-Site Scripting source: https://www.securityfocus.com/bid/27925/info IBM Lotus Quickr is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this...

CVE-2008-0834

Cross-site scripting XSS vulnerability in Lotus Quickr for i5/OS before 8.0.0.2 Hotfix 11, when anonymous access is disabled on HTTP ports, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...