CVE-2002-0407

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

domino.r4.txt

Lotus Domino R4 Web Server -- File Retreival Vulnerability Digisec.org Security Advisory Systems affected: Lotus Domino R4 Versions 4.x AIX - have not tested other versions/platforms Risk: High Date: July 2, 2002 Legal Notice: This advisory is Copyright c 2002 Digisec.org This advisory may be...

CVE-2001-1161

Cross-site scripting CSS vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script...

CVE-2001-0939

CVE-2001-0939 affects Lotus Domino 5.08 and earlier. A remote attacker can crash the service by sending a SunRPC NULL command to port 443, resulting in a denial of service. The connected documents do not specify a remediation (patch/workaround) within the provided details. The entry lists a CVSS ...

CVE-2001-0939

Lotus Domino 5.08 and earlier allows remote attackers to cause a denial of service crash via a SunRPC NULL command to port 443...

CVE-2001-1161

Affected software: IBM Domino (Lotus Domino) 5.0.6. Vulnerable component: cross-site scripting due to improper sanitization when requesting a '.nsf' file or URL ending with Javascript; an attacker can craft a URL to execute script in the user’s browser. Impact: remote script execution in the brow...

CVE-2001-1161: Undefined Security Weakness

Cross-site scripting CSS vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script...

CVE-2001-0939: Undefined Security Weakness

Lotus Domino 5.08 and earlier allows remote attackers to cause a denial of service crash via a SunRPC NULL command to port 443...

Lotus Domino Web Server discloses IP address

Overview Lotus Domino Web server discloses its IP address to some HTTP requests. Description Lotus Domino can be coerced to reveal its IP address by sending it a crafted HTTP request. --- Impact Attackers can discover limited information about the numbering of the Domino server's network. ---...

CVE-2002-0407

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

CVE-2002-0408

CVE-2002-0408 affects htcgibin.exe in Lotus Domino Server 5.0.9a and earlier. When configured with the NoBanner setting, a remote attacker can cause an HTTP 500 error and leak the server version in a hard-coded error message. This is an information-disclosure vulnerability that exposes version de...

CVE-2002-0407

CVE-2002-0407 affects Lotus Domino server prior to 5.0.9a. The vulnerability lies in htcgibin.exe, which can leak the server’s physical pathname to remote attackers via specially crafted requests that include MS-DOS device names (e.g., com5) or long sequences (such as a request with a .pl or .jav...

CVE-2002-0408

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

CVE-2002-0408: Undefined Security Weakness

htcgibin.exe in Lotus Domino server 5.0.9a and earlier, when configured with the NoBanner setting, allows remote attackers to determine the version number of the server via a request that generates an HTTP 500 error code, which leaks the version in a hard-coded error message...

CVE-2002-0407: Undefined Security Weakness

htcgibin.exe in Lotus Domino server 5.0.9a and earlier allows remote attackers to determine the physical pathname for the server via requests that contain certain MS-DOS device names such as com5, such as 1 a request with a .pl or .java extension, or 2 a request containing a large number of...

IBM Lotus Domino Banner Nonexistent .pl File Request Path Disclosure

The remote web server appears to be a version of Lotus Domino that allows an attacker to determine the physical path to the web root by requesting a non-existent '.pl' file. C Tenable Network Security, Inc. based on php3pathdisclosure by Matt Moore References From: "PeterGrundl" To: "bugtraq"...

CVE-2002-0245

Lotus Domino server 5.0.8 with NoBanner enabled allows remote attackers to 1 determine the physical path of the server via a request for a nonexistent file with a .pl Perl extension, which leaks the pathname in the error message, or 2 make any request that causes an HTTP 500 error, which leaks th...

IBM Lotus Domino Crafted .nsf Request Authentication Bypass

By creating a specially crafted URL, the authentication mechanism of the Domino database can be circumvented. These URLs should look like : http://host.com/.ntf.nsf/ in which has a certain length. %NASLMINLEVEL 70300 This script was written by Davy Van De Moere - CISSP [email protected] See the...

CVE-2001-1312

Format string vulnerabilities in Lotus Domino R5 before R5.0.7a allow remote attackers to cause a denial of service crash and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite...