CVE-2002-0370

CVE-2002-0370 refers to a buffer overflow/unchecked buffer in ZIP decompression in Windows ZIP handling affecting Windows 98 with Plus! Pack, XP, ME, Lotus Notes R4–R6, Verity KeyView, and StuffIt Expander before 7.0. OpenVAS and Nessus entries corroborate the MS02-054 fix. The vulnerability can ...

CVE-2012-2174

CVE-2012-2174 affects IBM Lotus Notes 8.x, where the URL handler for notes:// URLs is vulnerable to remote code execution. The vulnerability exists in the Lotus Notes URL handler prior to 8.5.3 FP2, allowing an attacker to execute arbitrary commands by convincing a user to open a crafted notes://...

CVE-2001-1504

The CVE-2001-1504 entry relates to Lotus Notes R5 Client 4.6, where a Lotus Notes object containing code in an event can be automatically executed when the user processes an e-mail message, enabling remote command execution. The vulnerability is rated CVSS v2 base score 7.5 (HIGH) with network at...

CVE-2008-4564

A stack-based buffer overflow in Autonomy KeyView SDK wp6sr.dll (WordPerfect document parser) allows remote code execution. The CVE-2008-4564 issue affects IBM Lotus Notes (and other products using KeyView), caused by unbounded copying of records into a fixed-size stack buffer when processing WPD...

CVE-2012-4820

CVE-2012-4820 affects IBM Java Runtime used in IBM WebSphere Real Time and other IBM products. The issue arises when code runs under a security manager, allowing remote attackers to escalate privileges by abusing insecure use of java.lang.reflect.Method invoke(). Affected IBM JREs include release...

CVE-2012-4821

CVE-2012-4821 is one of several IBM JRE/Java SDK vulnerabilities (CVE-2012-4820/4821/4822/4823) affecting IBM products (e.g., WebSphere Real Time, Tivoli Monitoring, Tivoli Storage Productivity Center, and related IBM runtimes). The root cause is insecure use of Java reflection APIs (getDeclaredM...

CVE-2007-5544

CVE-2007-5544 affects IBM Lotus Notes and Domino where memory-mapped files used for IPC are created with an ACL of Everyone:Full Control , allowing local attackers in shared environments to read sessions or inject content. Affected: Lotus Notes clients prior to 6.5.6, 7.x prior to 7.0.3; Domino s...

CVE-2012-4823

CVE-2012-4823 is an IBM JRE vulnerability (arbitrary code execution via insecure use of java.lang.ClassLoder defineClass()) affecting IBM JRE in multiple IBM and partner products. Connected advisories confirm concrete fixes by upgrading the IBM JRE to newer service releases on affected stacks: fo...

CVE-2006-0118

Affected software: IBM Lotus Notes and Domino Server before 6.5.5 running on AIX. Vulnerability details: denial of service via long formulas causing deep recursion leading to a stack overflow and crash. Impact: availability impact (partial) as per CVSS. Exploitability: network attack vector, low ...

CVE-2014-3086

CVE-2014-3086 is an IBM Java VM privilege-escalation issue impacting IBM Java SDK/JRE used in IBM WebSphere Real Time and related IBM products. The vulnerability allows untrusted code running under a security manager to escalate privileges, enabling remote code execution under the context of the ...

CVE-2012-4822

CVE-2012-4822 affects IBM JRE components used in IBM WebSphere Real Time and multiple IBM/Tivoli products (e.g., Tivoli Monitoring, Rational Host On-Demand, WebSphere Real Time, Lotus Notes/Domino). Root cause: insecure use of multiple methods in java.lang.Class enabling remote code execution. Af...

CVE-2005-2696

CVE-2005-2696 concerns IBM Lotus Notes/NAB where password hashes could be accessed remotely due to improper restriction of access to password hash data. The description specifies three leakage vectors: (1) password digest in the Administration tab of a Notes client, (2) PasswordDigest and HTTPPas...

CVE-2011-1213

In IBM Lotus Notes, the Autonomy KeyView component (lzhsr.dll) is vulnerable to a stack-based buffer overflow via a crafted .lzh header, caused by an integer underflow in KeyView’s parsing. A remote attacker could execute arbitrary code on affected systems running Lotus Notes before 8.5.2 FP3. Mi...

CVE-2006-5835

IBM Lotus Notes Domino NRPC allows unauthenticated user lookups, enabling remote attackers to obtain user ID files. Affected: Domino before 6.5.5 FP2 and 7.x before 7.0.2. Impact: potential disclosure of user IDs. Remediation: upgrade to 6.5.5 FP2+ or 7.0.2+. OpenVAS/NT-based tooling references i...

CVE-2013-0522

The CVE affects IBM Notes on Windows (versions 8.0–9.0) via the Notes Client Single Logon feature, where an unspecified OS communication mechanism used for password transmission between Windows and Notes allows local users to disclose passwords. The reports (NVD/NVD-derived entries and related ad...

CVE-2005-2618

CVE-2005-2618 is a buffer overflow affecting IBM/Lotus Notes components, notably the Attachment Viewer UUE handling and the HTML Speed Reader, exploited via specially crafted UUE files, long ZIP/TAR file names, or long links in emails. The root cause is inadequate boundary checking in these viewe...

CVE-2011-1512

CVE-2011-1512 is a heap-based buffer overflow in Autonomy KeyView’s xlssr.dll used by IBM Lotus Notes prior to 8.5.2 FP3. A malformed BIFF record in a .xls attachment can trigger memory corruption and remote code execution. Multiple security advisories (CoreLabs, OpenVAS, Tenable/Nessus) link CVE...

CVE-2014-0892

CVE-2014-0892 affects IBM Notes and Domino on Linux x86 (32-bit). The root cause is incorrect GCC options causing absence of NX protection, enabling a remote attacker to place crafted x86 code on the stack and execute arbitrary code. Affected versions: IBM Notes/Domino 8.5.x before 8.5.3 FP6 IF3 ...

CVE-2007-5405

CVE-2007-5405 is an Autonomy KeyView (kpagrdr.dll) buffer-overflow vulnerability affecting Applix Graphics (.ag) parsing. Secunia and related advisories document three overflow paths: (1) unsafe parsing of ENCODING in the *BEGIN tag, (2) boundary errors from overly long tokens, and (3) initial *B...

CVE-2013-0127

The CVE-2013-0127 entry applies to IBM Notes (Lotus Notes) 8.x prior to 8.5.3 FP4 Interim Fix 1 and 9.0 prior to Interim Fix 1, where HTML emails could contain APPLET elements that are not blocked. The underlying issue allows remote attackers to bypass Java execution restrictions and X-Confirm-Re...

CVE-2007-5909

CVE-2007-5909 is a buffer overflow vulnerability in Autonomy/Verity KeyView components (l123sr.dll, kpagrdr.dll, awsr.dll, exesr.dll, mwsr.dll, mifsr.dll, lasr.dll, rtfsr.dll) used by Lotus Notes 5.x–8.x. A crafted MIF/RTF/DOC/SAM/AS? attachments to these DLLs could cause a stack-based overflow, ...

CVE-2013-2977

CVE-2013-2977 describes an integer overflow in IBM Notes/Lotus Notes PNG image parsing that can allow a remote attacker to execute arbitrary code by convincing a user to view a malicious e‑mail. The root cause is an overflow during PNG parsing (width*4)*height allocation in the image decompressio...

CVE-2007-6593

CVE-2007-6593 is a buffer overflow in Autonomy KeyView (l123sr.dll) used by IBM Lotus Notes (versions 5.x–8.x) when viewing Lotus 1-2-3 (.123) Worksheet files. The vulnerability arises from a boundary/stack-based overflow in SRANGE handling, enabling user‑assisted remote code execution if a malic...

CVE-2009-3032

CVE-2009-3032 describes a heap-based buffer overflow in Autonomy KeyView Filter SDK (kvolefio.dll v8.5.0.8339 and v10.5.0.0) triggered by processing crafted OLE documents, impacting products that embed KeyView (e.g., IBM Lotus Notes 8.5, Symantec Mail Security for Microsoft Exchange 5.0.x). The v...

CVE-2011-1215

CVE-2011-1215 is a stack-based buffer overflow in Autonomy KeyView (mw8sr.dll) used by IBM Lotus Notes before 8.5.2 FP3. The vulnerability allows remote code execution via a crafted link in an Office document attachment. The issue is mapped to the KeyView filter used by multiple Symantec/Notes-re...

CVE-2011-0912

IBM Lotus Notes is affected by an argument-injection vulnerability in the cai:// URI handler that allows remote code execution via a --launcher.library option specifying a UNC DLL path. Affected are Lotus Notes 8.0.x prior to 8.0.2 FP6 and 8.5.x prior to 8.5.1 FP5. The flaw enables code execution...

CVE-2013-0536

IBM Notes 8.x/9.0 vulnerable to local privilege escalation via ntmulti.exe in the Multi-User Profile Cleanup service. Affected: Notes 8.0–8.5.x before FP5 and 9.0 before IF2; root cause is a code execution path during the next login of a different user. Impact: local privilege compromise (C/C/I/A...

CVE-1999-0429

The CVE-1999-0429 issue affects the Lotus Notes 4.5 client. The vulnerability arises when the user does not enable the Encrypt Saved Mail setting, allowing a copy of encrypted mail to be sent in the clear over the network. The NVD metrics indicate partial confidentiality and integrity/availabilit...

CVE-2006-0119

IBM Lotus Domino SMTP server is vulnerable to a denial-of-service via malformed vCal meeting requests. The routing service (nrouter.exe) can be driven to consume 100% CPU, potentially blocking mail delivery. The issue is unauthenticated and can be triggered remotely, with the vulnerability descri...

CVE-2006-0117

The vulnerability CVE-2006-0117 affects IBM Lotus Notes and Domino Server prior to version 6.5.5, where a buffer overflow in the CD to MIME Conversion path can cause a denial of service (router crash or hang). The description in the connected documents confirms the affected product and the underl...

CVE-2005-1405

CVE-2005-1405 affects Lotus Domino 6.5.x (before 6.5.4) and 6.0.x (before 6.0.5). The vulnerability is an HTTP response splitting flaw in the @SetHTTPHeader function, enabling attackers to poison the web cache through malicious applications. The provided sources describe the issue and affected ve...

CVE-2007-5399

Summary (CVE-2007-5399) : Multiple heap-based buffer overflows in the Autonomy/Verity KeyView EML reader (emlsr.dll) affect Autonomous KeyView 10.3.0.0, used by IBM Lotus Notes. Vulnerabilities arise from parsing problematic EML headers (To, Cc, Bcc, From, Date, Subject, Priority, Importance, X-M...

CVE-2011-1217

CVE-2011-1217 : Buffer overflow in kpprzrdr.dll within Autonomy KeyView, used by IBM Lotus Notes prior to 8.5.2 FP3, can be triggered by a crafted .prz attachment to remote-execute arbitrary code. The vulnerability affects the Lotus Notes workflow through the KeyView component, relies on a malfor...

CVE-2011-1218

Summary: CVE-2011-1218 is a buffer overflow in Autonomy KeyView’s kvarcve.dll, affecting IBM Lotus Notes prior to 8.5.2 FP3. A crafted ZIP attachment can trigger remote arbitrary-code execution. The issue is tied to the Verity KeyView Filter used by affected Note applications. Impact (as stated):...

CVE-2000-1117

CVE-2000-1117 affects the Lotus Notes Client R5. The JVM’s Extended Control List (ECL) feature enables a timing side channel via getSystemResource to infer whether a local file exists, by comparing dialog timing when a Java applet accesses local files. An attacker using a malicious applet in the ...

CVE-2007-5910

CVE-2007-5910 is a stack-based buffer overflow in Autonomy/Verity KeyView Viewer, Filter, and Export SDK prior to 9.2.0.12, exploited via crafted WordPerfect (WPD) attachments. It impacts Lotus Notes (wp6sr.dll) and other products (ActivePDF DocConverter, etc.), enabling remote code execution. Mi...

CVE-2009-3037

CVE-2009-3037 is a buffer overflow in the Autonomy KeyView XLS viewer (xlssr.dll) used by IBM Lotus Notes and multiple Symantec products (Mail Security, BrightMail, DLP, etc.). The overflow occurs while parsing Excel .xls attachments, enabling remote code execution by enticing a user to open a ma...

CVE-2010-5251

The CVE-2010-5251 entry concerns IBM Lotus Notes 8.5 with privilege escalation via untrusted search paths. A local user can gain privileges through Trojan horse DLLs (nnoteswc.dll or nlsxbe.dll) placed in the current working directory, demonstrated by a directory containing a .vcf, .vcs, or .ics ...

CVE-2007-4309

CVE-2007-4309 affects IBM Lotus Notes 5.x through 7.0.2. The description states that user‑assisted remote authenticated administrators can obtain a cleartext notes.id password by setting notes.ini (1) KFM_ShowEntropy and (2) Debug_Outfile, making this a vulnerability separate from CVE-2005-2696. ...

CVE-2004-0480

Affected software: IBM Lotus Notes 6.0.3–6.5. Vulnerability: argument injection via a notes: URI that uses a UNC network share path to supply an alternate notes.ini for notes.exe, enabling remote code execution. Root cause (as described): insufficient argument filtering on the URI handler, allowi...

CVE-2004-2281

Technical details about CVE-2004-2281 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2008-1101

CVE-2008-1101 is a buffer overflow in kvdocve.dll of Autonomy/Verity KeyView used by IBM Lotus Notes 7.0.2/7.0.3. The flaw can be triggered by an overly long SRC attribute in an IMG tag, enabling remote code execution. Affected component: kvdocve.dll in KeyView engine; vulnerable via processing l...

CVE-2006-0121

CVE-2006-0121 affects IBM Lotus Notes and Domino Server prior to 6.5.5. The issue consists of multiple memory leaks that can cause a denial of service (memory consumption and crash) via unknown vectors related to (1) SSL handshake vectors and (2) the stash file during the SSL handshake (SPR# MKIN...

CVE-2007-4222

CVE-2007-4222 describes a stack-based buffer overflow in IBM Lotus Notes’ nnotes.dll TagAttributeListCopy function. The flaw occurs when processing HTML emails that are converted to a temporary format (affecting how the recipient handles replies, forwards, or clipboard copies); a fixed-size stack...

CVE-2011-1214

IBM Lotus Notes (with Autonomy KeyView Verity Filter) is affected by CVE-2011-1214 due to a stack-based/buffer overflow in rtfsr.dll. The vulnerability allows remote code execution via a crafted link in a .rtf attachment, with impact as described in NVD (base score 9.3). It affects Lotus Notes pr...

CVE-2011-1216

CVE-2011-1216 is a stack-based buffer overflow in Autonomy KeyView’s Verity/assr.dll used by IBM Lotus Notes before 8.5.2 FP3. An attacker could trigger arbitrary code execution by crafting tag data in an Applix spreadsheet attachment, leading to remote code execution under the Notes process. The...

CVE-2005-2619

The CVE-2005-2619 issue affects Lotus Notes (6.5.4 and 7.0) using Autonomy/Verity KeyView SDK kvarcve.dll (pre-9.2.0). The vulnerability arises in the preview generation of archives (ZIP, UUE, TAR) where a filename containing .. can lead to directory traversal and deletion of arbitrary files acce...

CVE-2005-2175

The CVE-2005-2175 entry describes a cross-site scripting vulnerability in IBM Lotus Domino/Notes Web Access (DWA) and Lotus Notes mail: embedded JavaScript in HTML emails is executed automatically when opened, enabling an attacker to read/delete mail, access the user’s contact list, and potential...

CVE-2012-4846

CVE-2012-4846 is corroborated by OpenVAS entries describing IBM Lotus Notes Web Application XSS vulnerabilities across Linux, Windows, and Mac OS X. The OpenVAS tests (IDs 803216, 803215, 1361412562310803218, 1361412562310803215, 1361412562310803218) associate the CVE with an XSS issue in the Lot...

CVE-2004-2280

CVE-2004-2280 affects IBM Lotus Notes 6.5.x (before 6.5.3) and 6.0.x (before 6.0.5). It is a buffer overflow vulnerability that could allow remote attackers to cause a denial of service (crash) via unknown vectors related to Java applets (identified by KSPR62F4KN). The connected documents provide...