Page 3 of 18 results (0.012 seconds)

CVSS: 9.3EPSS: 92%CPEs: 11EXPL: 4

CVE-2010-3407 – IBM Lotus Domino iCalendar - Email Address Stack Buffer Overflow

https://notcve.org/view.php?id=CVE-2010-3407

Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V. Desbordamiento de búfer basado en pila en la función MailCheck821Address en nnotes.dll en el servicio nrouter.exe en el servidor IBM Lotus Domino v8.0.x anterior a v8.0.2 FP5 y v8.5.x anterior a v8.5.1 FP2 permite a atacantes remotos ejecutar código a su elección a través de una dirección de correo electrónico larga en un encabezado ORGANIZER:mailto en una mensaje de correo de invitación de calendario iCalendar, también conocido como SPR NRBY7ZPJ9V. • https://www.exploit-db.com/exploits/15005 https://www.exploit-db.com/exploits/17151 http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow http://labs.mwrinfosecurity.com/files/Advisories/mwri_lotus-domino-ical-stack-overflow_2010-09-14.pdf http://secunia.com/advisories/41433 http://securitytracker.com/id?1024448 http://www-01.ibm.com/support/docview.wss?uid=swg21446515 http://www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/52f9218288b51dcb852576c600741f72?OpenDocum • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 2

CVE-2010-0927

https://notcve.org/view.php?id=CVE-2010-0927

Cross-site scripting (XSS) vulnerability in help/readme.nsf/Header in the Help component in IBM Lotus Domino 7.x before 7.0.4 and 8.x before 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the BaseTarget parameter in an OpenPage action. NOTE: this may overlap CVE-2010-0920. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en help/readme.nsf/Header en the Help component en IBM Lotus Domino v7.x anteriores a v7.0.4 y v8.x anteriores a v8.0.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a través del parámetro "BaseTarget" en una acción OpenPage. NOTA: Esta vulnerabilidad se solapa con CVE-2010-0920. • http://www.cybsec.com/vuln/CYBSEC_Advisory_2010_0301_IBM_%20Lotus_Dominio_Readme_nsf_Reflected_XSS.pdf http://www.securityfocus.com/bid/38481 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.6EPSS: 5%CPEs: 31EXPL: 0

CVE-2010-0919

https://notcve.org/view.php?id=CVE-2010-0919

Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2 FP4 allows remote attackers to execute arbitrary code via a long URL argument to an unspecified method, aka PRAD7JTNHJ. Desbordamiento de búfer basado en pila en el control ActiveX Lotus Domino Web Access en IBM Lotus iNotes (alias Domino Web Access o DWA) 6.5, 7.0 en versiones anteriores a la 7.0.4, 8.0, 8.0.2 y en versiones anteriores a la 229.281 para Domino 8.0.2 FP4 permite a atacantes remotos ejecutar código de su elección mediante un argumento URL largo a un método no especificado, alias PRAD7JTNHJ. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=857 http://secunia.com/advisories/38681 http://secunia.com/advisories/38744 http://secunia.com/advisories/38755 http://securitytracker.com/id?1023662 http://www-01.ibm.com/support/docview.wss?uid=swg21421808 http://www-01.ibm.com/support/docview.wss?uid=swg27018109 http://www.osvdb.org/62612 http://www.securityfocus.com/bid/38457 http://www.securityfocus.com/bid/38459 http://www.vupen.com/english/advisories&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2008-7253

https://notcve.org/view.php?id=CVE-2008-7253

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398. La configuración por defecto del servidor Web en IBM Lotus Domino Server, posiblemente v6.0 hasta v8.0, activa el método HTTP TRACE method, lo que facilita a atacantes remotos a robar las cookies y las credenciales de autenticación a través de un taques de seguimiento de trazas en sitios cruzados (XST), está relacionado con CVE-2004-2763 y CVE-2005-3398. • http://www-01.ibm.com/support/docview.wss?&uid=swg21201202 http://www.kb.cert.org/vuls/id/867593 http://www.kb.cert.org/vuls/id/AAMN-5K42VN http://www.kb.cert.org/vuls/id/AAMN-5K42VT • CWE-16: Configuration •

CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 0

CVE-2010-0358

https://notcve.org/view.php?id=CVE-2010-0358

Heap-based buffer overflow in the server in IBM Lotus Domino 7 and 8.5 FP1 allows remote attackers to cause a denial of service (daemon exit) and possibly have unspecified other impact via a long string in a crafted LDAP message to a TCP port, a different vulnerability than CVE-2009-3087. Desbordamiento de búfer basado en pila en el servidor IBM Lotus Domino v7 y v8.5 FP1 permite a atacantes remotos producir una denegación de servicio (salida del demonio) y posiblemente obtener un impacto desconocido a través de una cadena larga en un mensaje LDAP manipulado hacia un puerto TCP, una vulnerabilidad diferente de CVE-2009-3087. • http://intevydis.blogspot.com/2010/01/lotus-domino-7-probably-8-ldap-heap.html http://intevydis.com/vd-list.shtml http://securitytracker.com/id?1023456 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •