CVE-2013-3983

The CVE-2013-3983 entry concerns IBM Sametime Meeting Server where the Meeting Server versions 8.5.2–8.5.2.1 and 9.x–9.0.0.1 do not validate URLs in Cookie headers before using them in redirects. This is the stated root cause. The impact is described as unspecified and the documents do not provid...

CVE-2013-6743

Cross-site scripting XSS vulnerability in the Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IMG element...

CVE-2013-6742

The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2013-3988

Summary: The IBM Sametime Meeting Server is reported vulnerable to clickjacking for versions 8.5.2–8.5.2.1 and 9.x–9.0.0.1. The issue is described as a remote-clickjacking risk with vectors unspecified. The cited CVSS v2 base score is 6.8 (Network, Low attack complexity, no authentication; partia...

CVE-2013-6743

The CVE-2013-6743 issue affects IBM Sametime Meeting Server, specifically version ranges 8.5.2–8.5.2.1 and 9.x–9.0.0.1. It is a Cross-site Scripting (XSS) vulnerability where remote authenticated users can inject arbitrary web script/HTML via IMG element vectors. The underlying root cause is not ...

CVE-2013-6727

The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2013-6727

The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2013-6727

IBM Lotus Sametime Connect Client (Windows) is affected by CVE-2013-6727. The vulnerability arises because the Connect client does not properly restrict unsigned Java plugins, enabling a remote attacker to disclose confidential information via unspecified vectors. Affected versions are IBM Sameti...

IBM Lotus Sametime WebPlayer DoS

This module exploits a known flaw in the IBM Lotus Sametime WebPlayer version 8.5.2.1392 and prior to cause a denial of service condition against specific users. For this module to function the target user must be actively logged into the IBM Lotus Sametime server and have the Sametime Audio Visu...

IBM Lotus Notes Sametime Room Name Bruteforce

This module bruteforces Sametime meeting room names via the IBM Lotus Notes Sametime web interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'IBM Lotus Notes Sametime...

IBM Lotus Notes Sametime User Enumeration

This module extracts usernames using the IBM Lotus Notes Sametime web interface using either a dictionary attack which is preferred, or a bruteforce attack trying all usernames of MAXDEPTH length or less. This module requires Metasploit: https://metasploit.com/download Current source:...

IBM Lotus Sametime Version Enumeration

This module scans an IBM Lotus Sametime web interface to enumerate the application's version and configuration information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule Release...

CVE-2013-6733

Cross-site scripting XSS vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6733

Cross-site scripting XSS vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6733

CVE-2013-6733 describes a cross-site scripting (XSS) vulnerability in the Web Application of the IBM Sametime Classic Meeting Server, affecting versions 7.5.1.2 through 8.5.2.1. The root cause is an XSS flaw in the Web Application component, allowing remote attackers to inject arbitrary script or...

CVE-2013-3045

The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function...

CVE-2013-3044

The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages, by leveraging meeting-attendance privileges...

CVE-2013-0537

The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges...

CVE-2013-3985

The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by leveraging a weak setting of the Domain variable...