CVE-2007-4222

Buffer overflow in the TagAttributeListCopy function in nnotes.dll in IBM Lotus Notes before 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML email, related to duplicate RTF conversion when the recipient operates on this email...

CVE-2007-4222

CVE-2007-4222 describes a stack-based buffer overflow in IBM Lotus Notes’ nnotes.dll TagAttributeListCopy function. The flaw occurs when processing HTML emails that are converted to a temporary format (affecting how the recipient handles replies, forwards, or clipboard copies); a fixed-size stack...

Session fixation

IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions Everyone:Full Control for memory mapped files shared memory in IPC, which allows local users to obtain sensitive information, or inject Lotus Script or other character...

CVE-2007-3510

Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name...

CVE-2007-5700

The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...

CVE-2007-5701

Incomplete blacklist vulnerability in the Certificate Authority CA in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information passwords when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character,...

CVE-2007-5544

IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions Everyone:Full Control for memory mapped files shared memory in IPC, which allows local users to obtain sensitive information, or inject Lotus Script or other character...

Design/Logic Flaw

The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...

Input validation

Incomplete blacklist vulnerability in the Certificate Authority CA in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information passwords when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character,...

Buffer overflow

Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name...

CVE-2007-5701

Incomplete blacklist vulnerability in the Certificate Authority CA in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information passwords when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character,...

CVE-2007-5544

IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions Everyone:Full Control for memory mapped files shared memory in IPC, which allows local users to obtain sensitive information, or inject Lotus Script or other character...

CVE-2007-3510

IBM Lotus Domino IMAP Server is affected by a buffer overflow in the IMAP service prior to 6.5.6 FP2 and prior to 7.0.3 for 7.x. A remote authenticated user can exploit this via a long mailbox name to execute arbitrary code in the server context. Exploitation often requires valid IMAP credentials...

CVE-2007-5700

The vulnerability (CVE-2007-5700) affects IBM Lotus Domino prior to 7.0.3. The Evaluate LotusScript method uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information. Affected co...

CVE-2007-3510

Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name...

CVE-2007-5544

CVE-2007-5544 affects IBM Lotus Notes and Domino where memory-mapped files used for IPC are created with an ACL of Everyone:Full Control , allowing local attackers in shared environments to read sessions or inject content. Affected: Lotus Notes clients prior to 6.5.6, 7.x prior to 7.0.3; Domino s...

CVE-2007-5700

The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information...

CVE-2007-5701

The CVE-2007-5701 entry concerns IBM Lotus Domino’s Certificate Authority (CA) before 7.0.3, with an incomplete blacklist vulnerability that allows local users or those with physical access to obtain passwords. When an administrator runs ca activate or ca unlock with any uppercase character, the ...

CVE-2007-3510.pl.txt

!perl "IBM Lotus Domino" IMAP4 Server 'LSUB' Command Exploit Author: Manuel Santamarina Suarez e-Mail: [email protected] use IO::Socket; use File::Basename; destination TCP port $port = 143; SE handler You can only use HEX values from 0x20 to 0x7e! printable ASCII characters You must use a...

PT-2007-6566 · Ibm · Ibm Domino +1

Name of the Vulnerable Software and Affected Versions: IBM Lotus Notes versions prior to 6.5.6 and 7.x prior to 7.0.3 IBM Domino versions prior to 6.5.5 FP3 and 7.x prior to 7.0.2 FP1 Description: The issue allows local users to obtain sensitive information or inject Lotus Script into a session d...