CVE-2004-2310

The CVE-2004-2310 entry concerns Lotus Domino R6 6.5.1, specifically the webadmin.nsf component, which is vulnerable to Cross-site Scripting (XSS). The vulnerability arises from accepting a Domino command via the Quick Console, enabling remote attackers to inject arbitrary web script/HTML. Accord...

CVE-2004-2369

Technical details (affected product/component/root cause/impact/fix) are not publicly available in the provided documents for CVE-2004-2369. Monitor official advisories for updates; current data only confirms a directory traversal vulnerability in webadmin.nsf.

CVE-2004-2311

Directory traversal vulnerability in webadmin.nsf in Lotus Domino R6 6.5.1 allows local users to create folders or determine the existence of files via a .. dot dot in the new folder dialog...

[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2005-2428

Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

CVE-2005-2428

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as 1 the password hash in the HTTPPassword field, 2 the password chan...

IBM Lotus Domino HTML Hidden Field Encrypted Password Disclosure

The remote host is running a version of Lotus Domino Server that is prone to several information disclosure vulnerabilities. Specifically, users' password hashes and other data are included in hidden fields in the public address book 'names.nsf' readable by default by all users. Moreover, Domino...

Lotus Domino Server Multiple Information Disclosure Vulnerabilities

Binary data 3114.prm...

IBM Lotus Domino Server time/date Fields Remote Overflow

According to its banner, the remote host is running a version of Lotus Domino Server that is prone to a buffer overflow attack triggered by submitting a POST request with large amounts of data for certain date / time fields. A remote attacker can reportedly exploit this issue to crash the web...

CVE-2004-2281

Technical details about CVE-2004-2281 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2004-2281

Multiple unknown vulnerabilities in IBM Lotus Notes 6.5.x before 6.5.4 and 6.0.x before 6.0.5 have unknown impact and attack vectors, related to Java applets, as identified by 1 KSPR5YS6GR and 2 KSPR62F4D3...

CVE-2004-2280

Buffer overflow in IBM Lotus Notes 6.5.x before 6.5.3 and 6.0.x before 6.0.5 allows remote attackers to cause a denial of service crash via unknown vectors related to Java applets, as identified by KSPR62F4KN...

CVE-2004-2280

CVE-2004-2280 affects IBM Lotus Notes 6.5.x (before 6.5.3) and 6.0.x (before 6.0.5). It is a buffer overflow vulnerability that could allow remote attackers to cause a denial of service (crash) via unknown vectors related to Java applets (identified by KSPR62F4KN). The connected documents provide...

CVE-2002-2014

Lotus Domino 5.0.8 web server is affected by CVE-2002-2014. The vulnerability arises because the server returns different error messages for valid versus invalid user names in HTTP requests, enabling remote attackers to enumerate valid accounts and facilitate brute-force attempts. The connected s...

CVE-2001-1567

CVE-2001-1567 affects IBM Lotus Domino Server up to 5.0.9a. A crafted HTTP request containing many "+" characters before a .nsf extension can cause Domino to convert pluses to spaces, allowing remote attackers to bypass security restrictions and view Notes database files and possibly sensitive No...

CVE-2002-2025

Lotus Domino server 5.0.9a and earlier allows remote attackers to cause a denial of service by exhausting the number of working threads via a large number of HTTP requests for 1 an MS-DOS device name and 2 an MS-DOS device name with a large number of characters appended to the device name...

CVE-2002-2025

CVE-2002-2025 affects Lotus Domino server 5.0.9a and earlier. The vulnerability allows remote attackers to cause a denial of service by exhausting the server’s working threads via a high volume of HTTP requests for (1) an MS-DOS device name and (2) an MS-DOS device name with a long appended name....

CVE-2002-2014

Lotus Domino 5.0.8 web server returns different error messages when a valid or invalid user is provided in HTTP requests, which allows remote attackers to determine valid user names and makes it easier to conduct brute force attacks...

CVE-2005-2175

The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers to conduct web-based attacks and steal cookies...