CVSS: 9.3EPSS: 77%CPEs: 1EXPL: 1CVE-2012-2176 – IBM Lotus Quickr QP2 ActiveX _Times Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-2176
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method. Múltiples desbordamientos de búfer en cierto ActiveX en qp2.cab en IBM Lotus Quickr v8.2 anterior a v8.2.0.27-002a para Domino permite a atacantes remotos ejecutar código arbitrario mediante un argumento largo para el método (1) Attachment_Times o (2) Import_Times. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Quickr. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the QP2.cab ActiveX control. When passing a long string argument to the Attachment_Times or Import_Times parameters during the control's instantiation it is possible to overflow a stack buffer causing memory corruption. • https://www.exploit-db.com/exploits/23737 http://www.ibm.com/support/docview.wss?uid=swg21596191 http://www.securityfocus.com/bid/53678 http://www.securitytracker.com/id?1027097 https://exchange.xforce.ibmcloud.com/vulnerabilities/75322 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 12%CPEs: 4EXPL: 0CVE-2012-0192
https://notcve.org/view.php?id=CVE-2012-0192
Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file. Múltiples desbordamientos de enteros en vclmi.dll en el módulo de biblioteca de clases visuales de IBM Lotus Symphony antes de v3.0.1 podrían permitir a atacantes remotos ejecutar código de su elección a través de un objeto de imagen (1) JPEG o (2) PNG integrado en un documento Symphony que desencadena un desbordamiento de buffer basado en memoria dinámica, tal y como se demuestra con un archivo .doc. • http://osvdb.org/78345 http://secunia.com/advisories/47245 http://www-01.ibm.com/support/docview.wss?uid=swg21578684 http://www.securityfocus.com/bid/51591 https://exchange.xforce.ibmcloud.com/vulnerabilities/72424 • CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2011-1393
https://notcve.org/view.php?id=CVE-2011-1393
Unspecified vulnerability in the authentication functionality in the server in IBM Lotus Domino 8.x before 8.5.2 FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Notes RPC packet. Vulnerabilidad sin especificar en la funcionalidad de autenticación en el servidor de IBM Lotus Domino 8.x anteriores a 8.5.2 FP4 permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de un paquete RPC Notes modificado. • http://secunia.com/advisories/47331 http://www.ibm.com/support/docview.wss?uid=swg21575247 http://www.osvdb.org/77990 https://exchange.xforce.ibmcloud.com/vulnerabilities/71805 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4465
https://notcve.org/view.php?id=CVE-2011-4465
Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden redirect URL. Una vulnerabilidad de ejecución de comandos en sitios cruzaods (XSS) en IBM Lotus Mobile Connect (LMC) v6.1.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con una URL oculta de redireccionamiento. • http://www.ibm.com/support/docview.wss?uid=swg1IV07148 http://www.ibm.com/support/docview.wss?uid=swg27020327 https://exchange.xforce.ibmcloud.com/vulnerabilities/72337 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2011-1370
https://notcve.org/view.php?id=CVE-2011-1370
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message. La configuración por defecto del servlet de configuración de Sametime (SCS) del servidor de IBM Lotus Sametime 7.0 hasta la versión 8.5.2 no habilita el requisito de autenticación, lo que permite a atacantes remotos leer las opciones de configuración examinando un mensaje de respuesta. • http://www-01.ibm.com/support/docview.wss?uid=swg21569452 https://exchange.xforce.ibmcloud.com/vulnerabilities/70923 • CWE-16: Configuration •