CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-1711
https://notcve.org/view.php?id=CVE-2017-1711
IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532. Las versiones 8.5 y 9.0 de IBM iNotes SUService pueden manipularse para que ejecuten código malicioso de un DLL disfrazado de DLL de windows en el directorio temp. IBM X-Force ID: 134532. • http://www.ibm.com/support/docview.wss?uid=swg22010774 http://www.ibm.com/support/docview.wss?uid=swg22010775 https://exchange.xforce.ibmcloud.com/vulnerabilities/134532 • CWE-426: Untrusted Search Path •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2017-1720
https://notcve.org/view.php?id=CVE-2017-1720
IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807. Las versiones 8.5 y 9.0 de IBM Notes podrían permitir que un atacante local ejecute comandos arbitrarios manipulando cuidadosamente una línea de comandos enviada mediante el IPC de la memoria compartida. IBM X-Force ID: 134807. • http://www.ibm.com/support/docview.wss?uid=swg22010766 http://www.ibm.com/support/docview.wss?uid=swg22010767 https://exchange.xforce.ibmcloud.com/vulnerabilities/134807 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 7EXPL: 0CVE-2016-0270
https://notcve.org/view.php?id=CVE-2016-0270
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue. IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 hasta la versión 9.0.1 Fix Pack 5 Interim Fix 1, cuando se usa TLS y AES GCM, utiliza generación aleatoria de nonce, lo que facilita a atacantes remotos obtener la clave de autenticación y suplantar datos aprovechando la reutilización de un nonce en una sesión y un "ataque prohibido". NOTA: esta CVE ha sido usada incorrectamente para problemas de reutilización de GCM nonce en otros productos; ver CVE-2016-10213 para el problema A10, CVE-2016-10212 para el problema Radware y CVE-2017-5933 para el problema Citrix. • http://www-01.ibm.com/support/docview.wss?uid=swg21979604 http://www-01.ibm.com/support/docview.wss?uid=swg21979669 http://www-01.ibm.com/support/docview.wss?uid=swg21979673 http://www.securityfocus.com/bid/96062 http://www.securitytracker.com/id/1037795 https://github.com/nonce-disrespect/nonce-disrespect https://support.citrix.com/article/CTX220329 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8921
https://notcve.org/view.php?id=CVE-2014-8921
The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by conducting a phishing attack involving an encrypted e-mail message. La aplicación IBM Notes Traveler Companion 1.0 y 1.1 anterior a 201411010515 para Window Phone, distribuido en IBM Notes Traveler 9.0.1, no restringe correctamente el número de ejecuciones de la opción de la configuración automática, lo que facilita a atacantes remotos capturar credenciales mediante la realización de un ataque de phishing involucrando un mensaje de email cifrado. • http://www-01.ibm.com/support/docview.wss?uid=swg21690582 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6130
https://notcve.org/view.php?id=CVE-2014-6130
The IBM Notes Traveler application before 9.0.1.3 for Android lacks a warning message during selection of an HTTP session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which the user had intended to use HTTPS. La aplicación IBM Notes Traveler anterior a 9.0.1.3 para Android le falta un mensaje de aviso durante la selección de una sesión HTTP, lo que facilita a atacantes remotos obtener información sensible mediante la captura de trafico de la red durante una sesión en la cual el usuario tuviera intención de utilizar HTTPS. • http://www-01.ibm.com/support/docview.wss?uid=swg21688840 http://www.kb.cert.org/vuls/id/432608 http://www.securityfocus.com/bid/70871 https://exchange.xforce.ibmcloud.com/vulnerabilities/96810 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •