CVE-2024-23562

CVE-2024-23562 concerns HCL Domino, where a remote unauthenticated attacker could cause disclosure of sensitive configuration information. The vulnerability stems from information disclosure in Domino, enabling an attacker to obtain configuration data that could be used to facilitate additional a...

CVE-2020-14230

CVE-2020-14230 affects HCL Domino. The vulnerability is a Denial of Service caused by improper validation of user-supplied input. A remote unauthenticated attacker can exploit this by sending a specially crafted email message, causing the server to hang. Affected versions are 9.0.1 FP10 IF6, 10.0...

CVE-2020-14273

CVE-2020-14273 affects HCL Domino server. The vulnerability stems from insufficient validation of input to the public API, enabling an unauthenticated attacker to crash the Domino server (DoS). CNVD notes impact on Domino 10 and 11; other connected sources reiterate the DoS description. No exploi...

CVE-2022-44750

CVE-2022-44750 affects HCL Domino (software previously licensed by IBM) via a stack-based buffer overflow in lasr.dll of Micro Focus KeyView. The vulnerability allows a remote, unauthenticated attacker to crash the application or execute arbitrary code by presenting a crafted Lotus Ami Pro file. ...

CVE-2020-14234

CVE-2020-14234 affects HCL Domino servers. The DoS stems from improper validation of user-supplied input, potentially crashing the server. Affected versions are before 9.0.1 FP10 IF6 and before 10.0.1. The connected sources confirm the same description; no exploitation or precise remediation deta...

CVE-2020-4080

The CVE-2020-4080 entry concerns HCL Verse v10 and v11 with a Stored Cross-Site Scripting (XSS) flaw due to improper handling of message content. Multiple connected sources (Red Hat, CNVD, CVE lists) confirm the vulnerability exists in HCL Verse v10/v11 and describe an unauthenticated remote atta...

CVE-2022-38654

CVE-2022-38654 affects HCL Domino. The vulnerability is an information disclosure where local server calls to search the Domino directory can ignore xACL read restrictions, allowing an authenticated attacker to access attributes from a user’s person record. Reported base metrics indicate CVSS v3....

CVE-2020-4107

CVE-2020-4107 concerns HCL Domino, where an Insufficient Access Control vulnerability allows an authenticated, locally-privileged attacker to escalate privileges, potentially causing denial of service or information disclosure. The available sources confirm the affected product and the local atta...

CVE-2022-27546

CVE-2022-27546 affects HCL iNotes with a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input in a form POST request. A remote attacker could lure a victim to a specially-crafted URL to run script in the site’s context and potentially steal cooki...

CVE-2022-27547

CVE-2022-27547 affects HCL iNotes (linked through non-existent domains) enabling an attacker to trick users into revealing sensitive information (e.g., credentials, payment data). The connected sources corroborate a domain-link-based abuse and cite iNotes/Domino as the impacted software, with no ...

CVE-2022-38660

HCL XPages applications are vulnerable to CSRF (CVE-2022-38660). An unauthenticated attacker could perform actions in the application on behalf of a logged-in user. The NVD entry lists CVSSv3.1 base score 8.8 (HIGH) with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; a CNA note with 8.3 (HIGH) shows A: LOW...

CVE-2022-27558

CVE-2022-27558 concerns HCL iNotes with a broken Password Strength Check, where custom password policies are not enforced on certain iNotes forms. The root cause, as described, is that password strength/policy enforcement may be bypassed, allowing users to set weak passwords and potentially enabl...

CVE-2020-14270

CVE-2020-14270 affects HCL Domino v9, v10, v11 with an information disclosure vulnerability in XPages caused by improper error handling of user input. The vulnerability allows an unauthenticated attacker to obtain information about the XPages software running on the Domino server. The available d...

CVE-2022-44752

CVE-2022-44752 affects HCL Domino with the wp6sr.dll component of Micro Focus KeyView. The vulnerability is a stack-based buffer overflow in wp6sr.dll that could allow a remote attacker to crash the application or execute arbitrary code via a crafted WordPerfect file. Affected software is describ...

CVE-2017-1712

CVE-2017-1712 is a vulnerability in the TLS protocol implementation of the Domino server where an unauthenticated, remote attacker can exploit a Bleichenbacher-like oracle (ROBOT) to decrypt previously captured TLS sessions. The issue arises from cryptanalytic operations enabled by iterative quer...

CVE-2020-14260

CVE-2020-14260 affects HCL Domino's DXL handling, where improper validation of user input leads to a buffer overflow. The vulnerability could crash the Domino server or allow attacker-controlled code execution via a network exploit with low complexity, no privileges, and no user interaction (CVSS...

CVE-2020-4128

CVE-2020-4128 affects HCL Domino’s ID Vault service, described as a lockout policy bypass that enables an unauthenticated attacker to perform brute-force attempts against the ID Vault. The available connected documents consistently state vulnerability existence and the brute-force risk; they do n...

CVE-2022-44754

CVE-2022-44754 (HCL Domino) describes a stack-based buffer overflow in lasr.dll of the Micro Focus KeyView engine. Affected software includes HCL Domino (software licensed from IBM) that embeds Lasr.dll. The vulnerability could allow a remote unauthenticated attacker to crash the application or e...

CVE-2020-14244

CVE-2020-14244 affects IBM Domino server (versions 9 and 10) with a MIME message handling flaw that can be exploited by an unauthenticated attacker to cause a stack buffer overflow. This could crash the server or allow code to be executed with server privileges. The connected sources confirm the ...

CVE-2023-37539

CVE-2023-37539 affects the Domino Catalog template. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw that an attacker can exploit if they have permission to edit documents in the catalog application/database created from this template; the attack is activated when an end user clicks ...

CVE-2023-37495

CVE-2023-37495 involves HCL Domino. The vulnerability arises from using a cryptographically weak hash algorithm to secure internet passwords stored in Person documents in the Domino Directory when created via the Add Person action on the People & Groups tab. The issue could allow an attacker with...

CVE-2023-28010

CVE-2023-28010 affects HCL Domino server. In certain configuration scenarios, the server host name can be exposed, enabling information disclosure that could facilitate targeted attacks. Several connected documents indicate Domino server exposure as the root cause, with mitigation via software fi...