CVSS: 9.3EPSS: 29%CPEs: 3EXPL: 0CVE-2013-3026 – IBM Quickr for Domino ActiveX Integer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3026
Buffer overflow in the Lotus Quickr for Domino ActiveX control in qp2.cab in IBM Lotus Quickr 8.1 before FP 8.1.0.32-001a, 8.2 before FP 8.2.0.28-001a, and 8.5.1 before FP 8.5.1.39-002a for Domino allows remote attackers to execute arbitrary code via a crafted web site. Desbordamiento de búfer en el control ActiveX Lotus Quickr para Domino en qp2.cab IBM Lotus Quickr 8.1 anterior a FP 8.1.0.32-001a, 8.2 anterior a FP 8.2.0.28-001a, y 8.5.1 anterior a FP 8.5.1.39-002a para Domino, permite a atacantes remotos ejecutar código arbitrario a través de un sitio web manipulado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Quickr for Domino. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of user provided input in an ActiveX control. An integer overflow exists which leads to a heap buffer overflow. • http://www-01.ibm.com/support/docview.wss?uid=swg21639643 https://exchange.xforce.ibmcloud.com/vulnerabilities/84381 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 77EXPL: 1CVE-2010-0715
https://notcve.org/view.php?id=CVE-2010-0715
Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the query string. Vulnerabilidad de redireccionamiento directo en login.jsp en IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), y IBM Lotus Workplace Web Content Management v5.1.0.0 hasta v5.1.0.5, v6.0.0.0 hasta v6.0.0.4, v6.0.1.0 hasta v6.0.1.7, v6.1.0.0 hasta v6.1.0.3, y v6.1.5.0; y IBM Lotus Quickr services v8.0, v8.0.0.2, v8.1, v8.1.1, y v8.1.1.1 para WebSphere Portal; permite a atacantes remotos redireccionar a los usuarios a sitios de su elección y conducir ataques phising a través de la cadena de la pregunta. • http://www-01.ibm.com/support/docview.wss?uid=swg21421469 http://www.hacktics.com/content/advisories/AdvIBM20100224.html http://www.securityfocus.com/archive/1/509744/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/56602 •
CVSS: 4.3EPSS: 0%CPEs: 77EXPL: 3CVE-2010-0714 – IBM (Multiple Products) - Login Page Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-0714
Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), y IBM Lotus Workplace Web Content Management v5.1.0.0 hasta v5.1.0.5, v6.0.0.0 hasta v6.0.0.4, v6.0.1.0 hasta v6.0.1.7, v6.1.0.0 hasta v6.1.0.3, y v6.1.5.0; y IBM Lotus Quickr services v8.0, v8.0.0.2, v8.1, v8.1.1, y v8.1.1.1 para WebSphere Portal; permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del cadena "query". • https://www.exploit-db.com/exploits/33675 http://www-01.ibm.com/support/docview.wss?uid=swg21421469 http://www-1.ibm.com/support/docview.wss?uid=swg1PM03233 http://www.hacktics.com/content/advisories/AdvIBM20100224.html http://www.securityfocus.com/archive/1/509744/100/0/threaded http://www.securityfocus.com/bid/38412 http://www.securitytracker.com/id?1023660 https://exchange.xforce.ibmcloud.com/vulnerabilities/56508 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3453
https://notcve.org/view.php?id=CVE-2009-3453
Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1.0 services for WebSphere Portal allow remote attackers to inject arbitrary web script or HTML via the filename of a .odt file in a Lotus Quickr place, related to the Library template. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en IBM Lotus Quickr v8.1.0 servicios para WebSphere Portal permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del nombre de fichero de un fichero .odt en Lotus Quickr place, relacionado con la plantilla Library. • http://osvdb.org/58384 http://secunia.com/advisories/36899 http://www-01.ibm.com/support/docview.wss?uid=swg1LO36646 http://www-01.ibm.com/support/docview.wss?uid=swg21405163 http://www.securityfocus.com/bid/36527 http://www.securitytracker.com/id?1022952 http://www.vupen.com/english/advisories/2009/2779 https://exchange.xforce.ibmcloud.com/vulnerabilities/53489 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •