IBM Lotus Notes sets insecure default permissions on program data

Overview IBM Lotus Notes sets insecure default permissions on the Notes directory. This vulnerability may allow a local attacker to gain unintended access to Lotus Notes program data. Description IBM Lotus Notes installs numerous program files and program data in a special directory known as the...

Weak IBM Lotus Notes client permissions

Application folder has Everyone:Full Control permissions...

Secunia Research: IBM Lotus Notes Insecure Default FolderPermissions

====================================================================== Secunia Research 18/10/2006 - IBM Lotus Notes Insecure Default Folder Permissions - ====================================================================== Table of Contents Affected...

CVE-2005-2454

IBM Lotus Notes 6.5.4/6.5.5 and 7.0.0/7.0.1 are affected by insecure default permissions on the Notes directory (Everyone: Full Control), enabling local users to gain unintended access and modify, add, or delete files in that folder. The issue is due to default folder permissions applied to the N...

CVE-2005-2454

IBM Lotus Notes 6.5.4 and 6.5.5, and 7.0.0 and 7.0.1, uses insecure default permissions Everyone/Full Control for the "Notes" folder and all children, which allows local users to gain privileges and modify, add, or delete files in that folder...

CVE-2006-3867

CVE-2006-3867 is a remote code execution vulnerability in Microsoft Excel triggered when Excel handles a crafted Lotus 1-2-3 file. The issue affects Excel on Windows (2000, XP, 2003) and Excel Viewer 2003, as well as Excel for Mac (2004) and Office v.X for Mac. The root cause is improper parsing ...

CVE-2006-3867

Unspecified vulnerability in Microsoft Excel 2000, 2002, 2003, 2004 for Mac, v.X for Mac, and Excel Viewer 2003 allows user-assisted attackers to execute arbitrary code via a crafted Lotus 1-2-3 file, a different vulnerability than CVE-2006-2387 and CVE-2006-3875...

Microsoft Excel fails to properly handle Lotus 1-2-3 files

Overview Microsoft Excel contains a vulnerability in the handling of malformed Lotus 1-2-3 files, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Excel contains an unspecified vulnerability that could be exploited when Exc...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

CVE-2006-4763

CVE-2006-4763 affects IBM Lotus Domino Web Access (DWA) 7.0.1, where the LtpaToken is not expired on logout. This can let an attacker intercept the LtpaToken cookie and gain the user’s privileges. Documented impact is that privileges can be obtained by token interception. The provided sources ide...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

Invalid Lotus Domino Web access sesssion cookie handling

Server accepts session cookie after user logout...

[Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

I. SYNOPSIS Title: Session Token Remains Valid After Logout in IBM Lotus Domino Web Access 7.0.1 Release Date: 09/12/2006 Affected Application: IBM Lotus Domino Web Access 7.0.1 versions prior to 7.0.1 were not tested but may still be vulnerable. Nominal Severity: Low Severity If Successfully...

IBM Lotus Notes DUNZIP32.dll Buffer Overflow Vulnerability

Networksecurity.fi Security Advisory 06-09-2006 Title: IBM Lotus Notes DUNZIP32.dll buffer overflow vulnerability Criticality: High 3/3 Affected software: IBM Lotus Notes versions 6.5.4, 5.0.10 and prior Author: Juha-Matti Laurio juha-matti.laurio at netti.fi Date: 6th September, 2006 Advisory ID...

BlackBerry Enterprise Server fails to properly handle Microsoft Word attachments

Overview A buffer overflow vulnerability in BlackBerry Enterprise Server may allow a remote attacker to execute arbitrary code. Description A buffer overflow vulnerability exists in the BlackBerry Attachment Service component of BlackBerry Enterprise Server. This vulnerability may allow a remote...

CVE-2006-3778

IBM Lotus Notes 6.0, 6.5, and 7.0 does not properly handle replies to e-mail messages with alternate name users when the 1 "Save As Draft" option is used or 2 a "," comma is inside the "phrase" portion of an address, which can cause the e-mail to be sent to users that were deleted from the To, CC...

CVE-2006-3778

IBM Lotus Notes 6.0, 6.5, and 7.0 does not properly handle replies to e-mail messages with alternate name users when the 1 "Save As Draft" option is used or 2 a "," comma is inside the "phrase" portion of an address, which can cause the e-mail to be sent to users that were deleted from the To, CC...

CVE-2006-3778

CVE-2006-3778 affects IBM Lotus Notes 6.0, 6.5, and 7.0. The issue arises in how replies to e‑mail messages with alternate name users are processed when (1) the Save As Draft option is used or (2) a comma is present in the phrase portion of an address. This can cause mail to be sent to users who ...

CVE-2006-3653

wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service CPU consumption or crash via crafted 1 Works, 2 Excel, and 3 Lotus 1-2-3 files...

Microsoft Windows XP/2003 Picture and Fax Viewer / Wine / ME code execution

Buffer overflow on parsing WMF metafiles. It may be used for silent Spyware/Trojan installation with Internet Explorer or another browser and also with Lotus Notes. There are vulnerabilities not covered by MS06-001...