CVE-2013-0591

Affected product: IBM Lotus Domino with iNotes 8.5.x (8.5.0–8.5.3 FP4) before 8.5.3 FP5. Vulnerability type: Cross-site Scripting (XSS) in iNotes 8.5.x due to an unspecified vector in the web interface. Root cause / impact: Remote authenticated users can inject arbitrary web script or HTML; impac...

CVE-2013-0590

Cross-site scripting XSS vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0591...

CVE-2013-0590

CVE-2013-0590 is an XSS vulnerability in IBM Lotus Domino’s iNotes 8.5.x (pre-8.5.3 FP5). The issue affects remote authenticated users who can inject arbitrary script/HTML via unspecified vectors in iNotes, per multiple sources (NVD entry describes XSS in iNotes 8.5.x; related CVE-2013-0591 docum...

IBM Lotus Domino 8.5.x < 8.5.3 FP 4 Multiple Vulnerabilities

According to its banner, the version of Lotus Domino on the remote host is 8.5.x earlier than 8.5.3 FP4. It is, therefore, affected by the following vulnerabilities : - An error exists related to the 'Autonomy KeyView' file parser that could allow arbitrary code execution. CVE-2012-6277 - A memor...

Lotus Quickr for Domino qp2.dll ActiveX Control Integer Overflow Remote Code Execution

An unspecified flaw in the Lotus Quickr for Domino qp2.dll ActiveX control has an unspecified integer overflow that leads to a heap buffer overflow. By tricking a victim into opening a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code, subject to th...

IBM Notes 8.5 < 8.5.3 IF4 HF2 / 9.0 < 9.0 IF2 Password Disclosure

The remote host has a version of Lotus Notes 8.5.x earlier than 8.5.3 Fix Pack 4 Interim Fix 2 or 9.0 earlier than Interim Fix 2. As such, it is potentially affected by an information disclosure vulnerability. IBM Notes may fail to zero the plaintext password within memory, leaving the plaintext...

IBM Notes 8.x < 8.5.3 IF4 HF2 / 9.x < 9.0 IF2 Code Execution

The remote host has a version of Lotus Notes 8.x earlier than 8.5.3 Fix Pack 4 Interim Fix 2 or 9.0 earlier than Interim Fix 2. As such, it is potentially affected by a code execution vulnerability. A flaw in the Multi-user Profile Cleanup Service enables an attacker to execute arbitrary code upo...

CVE-2013-3026

Buffer overflow in the Lotus Quickr for Domino ActiveX control in qp2.cab in IBM Lotus Quickr 8.1 before FP 8.1.0.32-001a, 8.2 before FP 8.2.0.28-001a, and 8.5.1 before FP 8.5.1.39-002a for Domino allows remote attackers to execute arbitrary code via a crafted web site...

Buffer overflow

Buffer overflow in the Lotus Quickr for Domino ActiveX control in qp2.cab in IBM Lotus Quickr 8.1 before FP 8.1.0.32-001a, 8.2 before FP 8.2.0.28-001a, and 8.5.1 before FP 8.5.1.39-002a for Domino allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2013-3026

Buffer overflow in the Lotus Quickr for Domino ActiveX control in qp2.cab in IBM Lotus Quickr 8.1 before FP 8.1.0.32-001a, 8.2 before FP 8.2.0.28-001a, and 8.5.1 before FP 8.5.1.39-002a for Domino allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2013-3026

CVE-2013-3026 affects IBM Lotus Quickr for Domino via the qp2.cab ActiveX control. An integer/heap overflow in qp2.dll/qp2.cab leads to remote code execution when a user visits a crafted web page with IE. Exploitation requires user interaction (per ZDI); successful exploitation could run code in ...

IBM Lotus Notes PNG Integer Overflow - CVE-2013-2977

IBM Lotus Notes is the client of a collaborative client-server plataform, being IBM Lotus Domino the application server. The email-client capability is one of its most important and used features. IBM Lotus Notes fails to correctly parse a PNG image file embedded in an email. Arbitrary code...

IBM Lotus Notes CVE-2013-2977 Integer Overflow Vulnerability

Description IBM Lotus Notes is prone to an integer-overflow vulnerability. Successful exploits may allow attackers to execute arbitrary code in the context of affected applications. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected IBM Lotus Notes 8...

CVE-2013-0127

IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and...

CVE-2013-0538

Cross-site scripting XSS vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49...

CVE-2013-0127

IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and...

Code injection

IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and...

CVE-2013-0127

IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and...

CVE-2013-0538

Cross-site scripting XSS vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49...