CVSS: 4.7EPSS: 0%CPEs: 15EXPL: 0CVE-2012-3301
https://notcve.org/view.php?id=CVE-2012-3301
21 Aug 2012 — Multiple CRLF injection vulnerabilities in the HTTP server in IBM Lotus Domino 8.5.x before 8.5.4 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input involving (1) Mozilla Firefox 3.0.9 and earlier or (2) unspecified browsers. Múltiples vulnerabilidades de inyección CRLF en el servidor HTTP en IBM Lotus Domino v8.5.x anterior a v8.5.4 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de respue... • http://websecurity.com.ua/5839 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 24EXPL: 0CVE-2012-3302
https://notcve.org/view.php?id=CVE-2012-3302
21 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Domino 7.x and 8.x before 8.5.4 allow remote attackers to inject arbitrary web script or HTML via (1) a URL accessed during use of the Mail template in the WebMail UI or (2) a URL accessed during use of Domino Help through the Domino HTTP server. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en IBM Lotus Domino v7.x y v8.x anterior a v8.5.4 permite a atacantes remotos inyectar código arbitrario web o HTML a travé... • http://websecurity.com.ua/5839 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 8%CPEs: 33EXPL: 1CVE-2011-1519 – IBM Lotus Domino Server Controller - Authentication Bypass
https://notcve.org/view.php?id=CVE-2011-1519
25 Mar 2011 — The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field. NOTE: this might overlap CVE-2011-0920. La consola remota en el controlador del servidor de IBM Lotus Domino v7.x y v8.x comprueba las credenciales contra un archivo ubicado en una ruta de acceso ... • https://www.exploit-db.com/exploits/18179 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 7%CPEs: 74EXPL: 0CVE-2011-0913 – Lotus Domino Server diiop getEnvironmentString Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0913
07 Feb 2011 — Stack-based buffer overflow in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP getEnvironmentString request, related to the local variable cache. Desbordamiento de búfer basado en pila en ndiiop.exe en la aplicación DIIOP en el servidor de IBM Lotus Domino v8.5.3 y anteriores, permite a atacantes remotos ejecutar código de su elección mediante una petición getEnvironmentString de GIOP, relacionado con la caché... • http://secunia.com/advisories/43208 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 70%CPEs: 74EXPL: 0CVE-2011-0915 – IBM Lotus Domino iCalendar Meeting Request Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0915
07 Feb 2011 — Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes calendar (aka iCalendar or iCal) meeting request, aka SPR KLYH87LL23. Desbordamiento de búfer basado en pila en nrouter.exe en IBM Lotus Domino v8.5.3 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de un parámetro de nombre largo en el encabezado Content-Type de convocatoria de ... • http://secunia.com/advisories/43208 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 15%CPEs: 74EXPL: 0CVE-2011-0914 – Lotus Domino Server diiop Client Request Operation Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0914
07 Feb 2011 — Integer signedness error in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP client request, leading to a heap-based buffer overflow. Error de presencia de signo (signedness) en enteros en ndiiop.exe en la aplicación DIIOP en el servidor de IBM Lotus Domino v8.5.3 y anteriores, permite a atacantes remotos ejecutar código se elección mediante una petición del cliente GIOP, dando lugar a un desbordamiento de búfe... • http://secunia.com/advisories/43208 • CWE-189: Numeric Errors •