CVSS: 8.4EPSS: 0%CPEs: 19EXPL: 0CVE-2018-1771
https://notcve.org/view.php?id=CVE-2018-1771
IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687. IBM Domino 9.0 y 9.0.1 podría permitir que un atacante ejecute comandos en el sistema desencadenando un desbordamiento de búfer en el análisis de los argumentos de la línea de comandos que se pasan a nsd.exe. IBM X-Force ID: 148687. • https://exchange.xforce.ibmcloud.com/vulnerabilities/148687 https://www.ibm.com/support/docview.wss?uid=ibm10743405 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0CVE-2016-6087
https://notcve.org/view.php?id=CVE-2016-6087
IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918. IBM Domino versiones 8.5 y 9.0 podría permitir a un atacante robar credenciales utilizando varias sesiones y grandes cantidades de datos mediante la validación de Domino TLS Key Exchange. IBM X-Force ID: 117918. • http://www.ibm.com/support/docview.wss?uid=swg22002808 http://www.securityfocus.com/bid/98794 http://www.securitytracker.com/id/1038606 https://exchange.xforce.ibmcloud.com/vulnerabilities/117918 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2017-1274 – Lotus Domino 8.5.3 - 'EXAMINE' Stack Buffer Overflow DEP/ASLR Bypass (NSA's EMPHASISMINE)
https://notcve.org/view.php?id=CVE-2017-1274
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749. IBM Domino versiones 8.5.3 y 9.0 es vulnerable a desbordamiento basado en pila en el servicio IMAP lo que podría permitir a un atacante autenticado ejecutar código arbitrario especificando un nombre largo de buzón. IBM X-Force ID: 124749. • https://www.exploit-db.com/exploits/46808 http://packetstormsecurity.com/files/152786/Lotus-Domino-8.5.3-EXAMINE-Stack-Buffer-Overflow.html http://www.ibm.com/support/docview.wss?uid=swg22002280 http://www.securityfocus.com/bid/97910 http://www.securityfocus.com/bid/98019 http://www.securitytracker.com/id/1038358 https://www.kb.cert.org/vuls/id/676632 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 7EXPL: 0CVE-2016-0270
https://notcve.org/view.php?id=CVE-2016-0270
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue. IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 hasta la versión 9.0.1 Fix Pack 5 Interim Fix 1, cuando se usa TLS y AES GCM, utiliza generación aleatoria de nonce, lo que facilita a atacantes remotos obtener la clave de autenticación y suplantar datos aprovechando la reutilización de un nonce en una sesión y un "ataque prohibido". NOTA: esta CVE ha sido usada incorrectamente para problemas de reutilización de GCM nonce en otros productos; ver CVE-2016-10213 para el problema A10, CVE-2016-10212 para el problema Radware y CVE-2017-5933 para el problema Citrix. • http://www-01.ibm.com/support/docview.wss?uid=swg21979604 http://www-01.ibm.com/support/docview.wss?uid=swg21979669 http://www-01.ibm.com/support/docview.wss?uid=swg21979673 http://www.securityfocus.com/bid/96062 http://www.securitytracker.com/id/1037795 https://github.com/nonce-disrespect/nonce-disrespect https://support.citrix.com/article/CTX220329 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 51EXPL: 0CVE-2016-5884
https://notcve.org/view.php?id=CVE-2016-5884
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM iNotes es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente conduce a la divulgación de credenciales dentro de una sesión de confianza. • http://www.ibm.com/support/docview.wss?uid=swg21992835 http://www.securityfocus.com/bid/94602 http://www.securitytracker.com/id/1037383 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •