CVE-2002-2191

Lotus Domino 5.0.9a and earlier, even when configured with the 'DominoNoBanner=1' option, allows remote attackers to obtain potential sensitive information such as the version via a request for a non-existent .nsf database, which leaks the version in the HTTP banner...

Lotus Domino 5.0.8-9 - Non-Existent NSF Database Banner Information Disclosure

source: https://www.securityfocus.com/bid/6128/info Lotus Domino reportedly discloses sensitive banner information when a non-existent NSF database is requested. This may allow a remote attacker to discover information about the layout of the filesystem. This issue is present on Lotus Domino Serv...

Lotus Domino 5.0.8-9 - Non-Existent NSF Database Banner Information Disclosure

Lotus Domino 5.0.8-9 - Non-Existent NSF Database Banner Information Disclosure source: https://www.securityfocus.com/bid/6128/info Lotus Domino reportedly discloses sensitive banner information when a non-existent NSF database is requested. This may allow a remote attacker to discover information...

R7-0004: Multiple Vendor Long ZIP Entry Filename Processing

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rapid 7, Inc. Security Advisory Visit http://www.rapid7.com/ to download NeXposetm, our advanced vulnerability scanner. Linux and Windows 2000 versions are available now! Rapid 7 Advisory R7-0004 Multiple Vendor Long ZIP Entry Filename Processing Issu...

CVE-2002-1010

Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a "?" character, which is treated as a wildcard character and bypasses the web handlers...

CVE-2002-1010

CVE-2002-1010 affects Lotus Domino R4. The vulnerability allows remote attackers to bypass access restrictions for files in the web root by issuing an HTTP request with a trailing “?”, which is treated as a wildcard and bypasses the web handlers. The available sources describe the issue and its i...

CVE-2002-1010

Lotus Domino R4 allows remote attackers to bypass access restrictions for files in the web root via an HTTP request appended with a "?" character, which is treated as a wildcard character and bypasses the web handlers...

CVE-2002-0407

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

domino.r4.txt

Lotus Domino R4 Web Server -- File Retreival Vulnerability Digisec.org Security Advisory Systems affected: Lotus Domino R4 Versions 4.x AIX - have not tested other versions/platforms Risk: High Date: July 2, 2002 Legal Notice: This advisory is Copyright c 2002 Digisec.org This advisory may be...

CVE-2001-1161

Cross-site scripting CSS vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script...

CVE-2001-0939

CVE-2001-0939 affects Lotus Domino 5.08 and earlier. A remote attacker can crash the service by sending a SunRPC NULL command to port 443, resulting in a denial of service. The connected documents do not specify a remediation (patch/workaround) within the provided details. The entry lists a CVSS ...

CVE-2001-0939

Lotus Domino 5.08 and earlier allows remote attackers to cause a denial of service crash via a SunRPC NULL command to port 443...

CVE-2001-1161

Affected software: IBM Domino (Lotus Domino) 5.0.6. Vulnerable component: cross-site scripting due to improper sanitization when requesting a '.nsf' file or URL ending with Javascript; an attacker can craft a URL to execute script in the user’s browser. Impact: remote script execution in the brow...

Lotus Domino Web Server discloses IP address

Overview Lotus Domino Web server discloses its IP address to some HTTP requests. Description Lotus Domino can be coerced to reveal its IP address by sending it a crafted HTTP request. --- Impact Attackers can discover limited information about the numbering of the Domino server's network. ---...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

CVE-2002-0407

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

CVE-2002-0407

CVE-2002-0407 affects Lotus Domino server prior to 5.0.9a. The vulnerability lies in htcgibin.exe, which can leak the server’s physical pathname to remote attackers via specially crafted requests that include MS-DOS device names (e.g., com5) or long sequences (such as a request with a .pl or .jav...

CVE-2002-0408

CVE-2002-0408 affects htcgibin.exe in Lotus Domino Server 5.0.9a and earlier. When configured with the NoBanner setting, a remote attacker can cause an HTTP 500 error and leak the server version in a hard-coded error message. This is an information-disclosure vulnerability that exposes version de...

IBM Lotus Domino Banner Nonexistent .pl File Request Path Disclosure

The remote web server appears to be a version of Lotus Domino that allows an attacker to determine the physical path to the web root by requesting a non-existent '.pl' file. C Tenable Network Security, Inc. based on php3pathdisclosure by Matt Moore References From: "PeterGrundl" To: "bugtraq"...