CVE-2012-4820

CVE-2012-4820 affects IBM Java Runtime used in IBM WebSphere Real Time and other IBM products. The issue arises when code runs under a security manager, allowing remote attackers to escalate privileges by abusing insecure use of java.lang.reflect.Method invoke(). Affected IBM JREs include release...

CVE-2012-4821

CVE-2012-4821 is one of several IBM JRE/Java SDK vulnerabilities (CVE-2012-4820/4821/4822/4823) affecting IBM products (e.g., WebSphere Real Time, Tivoli Monitoring, Tivoli Storage Productivity Center, and related IBM runtimes). The root cause is insecure use of Java reflection APIs (getDeclaredM...

CVE-2012-4823

CVE-2012-4823 is an IBM JRE vulnerability (arbitrary code execution via insecure use of java.lang.ClassLoder defineClass()) affecting IBM JRE in multiple IBM and partner products. Connected advisories confirm concrete fixes by upgrading the IBM JRE to newer service releases on affected stacks: fo...

CVE-2012-4822

CVE-2012-4822 affects IBM JRE components used in IBM WebSphere Real Time and multiple IBM/Tivoli products (e.g., Tivoli Monitoring, Rational Host On-Demand, WebSphere Real Time, Lotus Notes/Domino). Root cause: insecure use of multiple methods in java.lang.Class enabling remote code execution. Af...

CVE-2013-0536

IBM Notes 8.x/9.0 vulnerable to local privilege escalation via ntmulti.exe in the Multi-User Profile Cleanup service. Affected: Notes 8.0–8.5.x before FP5 and 9.0 before IF2; root cause is a code execution path during the next login of a different user. Impact: local privilege compromise (C/C/I/A...

CVE-2012-5307

CVE-2012-5307 is described as a cross-site scripting (XSS) vulnerability in IBM Lotus Notes Traveler’s servlet/traveler code. The advisory specifies that when Firefox is used, attackers can inject arbitrary web script or HTML via the redirectURL parameter. This is a distinct issue from CVE-2012-4...

CVE-2012-4824

CVE-2012-4824: Open redirect in IBM Lotus Notes Traveler 8.5.3 prior to 8.5.3.3 Interim Fix 1; a remote attacker can cause user navigation to an arbitrary site via redirectURL in servlet/traveler. Impact: phishing risk; no exploitation details provided. Mitigation: apply IBM 8.5.3.3 Interim Fix 1...

CVE-2010-4550

CVE-2010-4550: IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to cause a denial of service (sync failure) via a malformed document. This is corroborated across multiple connected records (NVD, Red Hat, CVE lists, PRION) with the same impact description. No exploitation details, v...

CVE-2010-4545

IBM Lotus Notes Traveler before 8.5.1.2 is affected. A remote authenticated user can cause a denial of service (resource consumption and sync outage) by syncing a large volume of data. The CVSSv2 base score is 4.0 (Medium); attack vector Network, authentication Single, impact: Availability Partia...

CVE-2012-4825

CVE-2012-4825 affects IBM Lotus Notes Traveler before 8.5.3.2. The vulnerability lies in the servlet/traveler/ILNT.mobileconfig component, where an attacker can inject arbitrary web script or HTML via the (1) userId or (2) address parameter in a getClientConfigFile action, resulting in cross-site...

CVE-2009-5035

Technical details about CVE-2009-5035 are not publicly provided in the supplied documents. The available records only reiterate the vulnerability description; monitor for updates for affected products and fixes.

CVE-2010-4551

IBM Lotus Notes Traveler prior to 8.5.1.2 is affected: vulnerability arises when the Internet ID field in a person document is omitted, enabling remote authenticated users to trigger a NULL pointer dereference that crashes the Traveler daemon via Apple-device invitation acceptance/decline. Affect...

CVE-2010-4552

The CVE pertains to IBM Lotus Notes Traveler before 8.5.1.1, where a memory leak in processing emails with embedded objects for iPhone clients can lead to denial of service via memory consumption and daemon outage. Affected component: Lotus Notes Traveler; root cause: memory leak. Exploitation de...

CVE-2009-5036

CVE-2009-5036 affects traveler.exe in IBM Lotus Notes Traveler prior to 8.0.1.3 CF1. A remote authenticated user can trigger a denial of service (daemon crash) via a malformed invitation document in a sync operation. No additional exploit details, impact scope, or mitigations are provided in the ...

CVE-2010-4549

CVE-2010-4549 affects IBM Lotus Notes Traveler prior to version 8.5.1.3 on Nokia S60 devices. The issue is a logic/authorization problem where a Replace Data operation can target a prohibited application, enabling remote authenticated users to bypass intended access restrictions. Public exploitat...

CVE-2010-4544

CVE-2010-4544 affects IBM Lotus Notes Traveler (servlet) prior to version 8.5.1.3. The issue is a cross-site scripting (XSS) vulnerability allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available documents confirm the affected product and the underly...

CVE-2009-5034

IBM Lotus Notes Traveler before 8.5.0.2 is affected by a DoS vulnerability: remote authenticated users can trigger memory consumption and daemon crash by syncing a large volume of data, due to launching a new process to handle the data while the previous process is still operating. The available ...

CVE-2010-4553

CVE-2010-4553 : An unspecified Domino API in IBM Lotus Notes Traveler prior to 8.5.1.1 does not properly handle MIME types, enabling a remote attacker to cause a denial of service (daemon crash) via unspecified vectors. The vulnerability affects IBM Lotus Notes Traveler before version 8.5.1.1; no...

CVE-2010-4546

CVE-2010-4546 affects IBM Lotus Notes Traveler prior to 8.5.1.2. The issue arises when handling an attachment download request for an e-mail message with a Prevent Copy attribute, where the system does not reject the request. This allows remote authenticated users to bypass intended access restri...

CVE-2010-4547

CVE-2010-4547 affects IBM Lotus Notes Traveler before 8.5.1.3. In a multidomain environment, the server fails to properly apply policy documents to mobile users from a different Domino domain, allowing remote authenticated users to bypass access restrictions by using credentials from another doma...

CVE-2010-4548

CVE-2010-4548 affects IBM Lotus Notes Traveler prior to 8.5.1.2. A remote authenticated user can cause a denial of service (daemon crash) by first accepting a meeting invitation with an iNotes client and then accepting the same invitation with an iPhone client. The available sources confirm this ...

CVE-2009-5033

IBM Lotus Notes Traveler before 8.5.0.2 is affected by an input handling flaw in a tell command that accepts a "* *" argument sequence. This allows remote authenticated users to access other users’ data via a sync operation, due to how data for multiple users is stored within the same thread. The...

CVE-2012-5309

The vulnerability CVE-2012-5309 affects IBM Lotus Notes Traveler up to 8.5.3.3 Interim Fix 1. The issue is in the servlet/traveler component, which does not properly restrict invalid authentication attempts, enabling easier remote brute-force access. Impact is described as partial confidentiality...

CVE-2009-5032

CVE-2009-5032 affects IBM Lotus Notes Traveler

CVE-2012-5308

The CVE-2012-5308 entry concerns IBM Lotus Notes Traveler (servlet/traveler) with a CSRF vulnerability that, through to version 8.5.3.3 Interim Fix 1, allows remote attackers to hijack the authentication of arbitrary users via requests that create problem reports using a getReportProblem upload a...