Lotus Domino Web server vulnerability

Tested on : ----------- LOTUS DOMINO 5.0.5 french and LOTUS DOMINO 5.0.8 french with http service running. OS : Windows NT 4.0 sp4 Description : ------------- With a particular craft URL, an anonymous users can lock the databases accesses. Result : Any notes users even the administrators and the...

CVE-2001-0954

Lotus Domino 5.0.5 and 5.0.8, and possibly other versions, allows remote attackers to cause a denial of service block access to databases that have not been previously accessed via a URL that includes the . dot directory...

CVE-2001-0847

Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via 1 URL encoding the request, or 2 directly requesting the ReplicaID...

CVE-2001-0846

Lotus Domino 5.x allows remote attackers to read files or execute arbitrary code by requesting the ReplicaID of the Web Administrator template file webadmin.ntf...

Lotus Domino R5 Server vulnerable to DoS via nmap RPC scan on port 443/tcp

Overview Versions earlier than 5.0.9 of Lotus Domino R5 Servers with Secure Socket Layer SSL enabled are vulnerable to a denial of sevice. Description A remote user is able to crash the HTTP serving process on any Lotus Domino R5 Server using the nmap utility. Sending a request to port 443, the...

DoS против Lotus Domino

Отказ в обслуживании при неправильных данных HTTP через SSL TCP/443...

Denial of Service in Lotus Domino 5.08 and earlier HTTP Server

There exists a DOS in the current version of Lotus Domino 5.08 and earlier. The DOS manifests itself on Lotus Domino servers with the http task running and ssl enabled. A connection to the victim on port 443 with the nmap '-sR' switch will target this port with SunRPC program NULL commands in an...

CVE-2001-0939

Lotus Domino 5.08 and earlier allows remote attackers to cause a denial of service crash via a SunRPC NULL command to port 443...

CVE-2001-0847

CVE-2001-0847 affects Lotus Domino Web Server 5.x. The vulnerability allows remote attackers to disclose sensitive information by accessing the default navigator $defaultNav, either by URL-encoding the request or by directly requesting the ReplicaID. The public records describe the affected compo...

CVE-2001-0847

Lotus Domino Web Server 5.x allows remote attackers to gain sensitive information by accessing the default navigator $defaultNav via 1 URL encoding the request, or 2 directly requesting the ReplicaID...

Lotus Domino Web Administrator Template ReplicaID Access (#NISR29102001A)

NGSSoftware Insight Security Research Advisory Name: Lotus Domino Web Administrator Template ReplicaID Access Systems Affected: Lotus Domino 5.x on all operating systems Severity: High Risk Vendor URL: http://www.lotus.com/ Author: David Litchfield [email protected] Date: 29th October 2001...

Lotus Domino View ACL by-pass (#NISR29102001C)

NGSSoftware Insight Security Research Advisory Name: Lotus Domino View ACL by-pass Systems Affected: Lotus Domino Web Server 5.x on all operating systems Severity: Possibly high Vendor URL: http://www.lotus.com/ Author: David Litchfield [email protected] Date: 29th October 2001 Advisory number:...

Lotus Domino Default Navigator Protection By-pass (#NISR29102001B)

NGSSoftware Insight Security Research Advisory Name: Lotus Domino Default Navigator Protection By-pass Systems Affected: Lotus Domino Web Server 5.x on all operating systems Severity: Low Vendor URL: http://www.lotus.com/ Author: David Litchfield [email protected] Date: 29th October 2001 Adviso...

Несоклько проблем в Lotus Domino (protection bypass)

Различные уязвимости включая частичный удаленный доступ к административному интерфейсу...

Security BugWare Advisory

----www.securitybugware.org---- A D V I S O R I E S Dear World, From 1996 to 9th Sep 2001, Hrvoje Crvelin maintained the most explicit website about bugs, exploits, and solutions. He decided to stop this project. As there is no such resource on the web, we decided to keep this one alive. Behind t...

Управляющие элементы в письмах Lotus Notes (code execution)

Письма Lotus Notes могут содержать исполняемые процедуры VBS, которые будут выполнены незаметно для пользователя...

CVE-2001-1018

Lotus Domino web server 5.08 allows remote attackers to determine the internal IP address of the server when NAT is enabled via a GET request that contains a long sequence of / slash characters...

lotus domino server 5.08 is very gabby

maybe this is nothing new, but when i looked at some html raw headers after i surfed to a lotus domino 5.08 webserver, he tells me the following information : Lotus-Domino Release 5.0.8 - June 18, 2001 on AIX and further a request like this : GET //////////// HTTP/1.0 gives me the internal...

Получение реального IP сервера Lotus Domino (information leakage)

С помощью запроса GET //////////// HTTP/1.0 можно получить сведения о реальном IP Сервера...

Default installations of the Lotus Domino web server disclose system information via HTTP headers

Overview The default configuration of the Lotus Domino web server discloses system characteristics to anonymous remote users. Description The default configuration of the Lotus Domino web server discloses system information in the HTTP headers it returns to a web browser. If these headers are...