CVSS: 10.0EPSS: 97%CPEs: 5EXPL: 2CVE-2008-2240 – IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
https://notcve.org/view.php?id=CVE-2008-2240
Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header. Desbordamiento de búfer basado en pila en el Servicio Web Server en IBM Lotus Domino anterior a 7.0.3 FP1 y 8.x anterior a 8.0.1, permite a atacantes remotos provocar una denegación de servicio (caída de demonio) o la posibilidad de ejecutar código de su elección a través de una cabecera HTTP "Accept-Languaje". • https://www.exploit-db.com/exploits/16697 http://secunia.com/advisories/30310 http://secunia.com/advisories/30332 http://www-1.ibm.com/support/docview.wss?uid=swg21303057 http://www.attrition.org/pipermail/vim/2008-May/001988.html http://www.attrition.org/pipermail/vim/2008-May/001989.html http://www.mwrinfosecurity.com/publications/mwri_ibm-lotus-domino-accept-language-stack-overflow_2008-05-20.pdf http://www.securityfocus.com/bid/29310 http://www.securitytracker.com/id?1020098 h • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-2410
https://notcve.org/view.php?id=CVE-2008-2410
Cross-site scripting (XSS) vulnerability in the servlet engine and Web container in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el motor de servlets y el contenedor Web en el servicio Web Server de IBM Lotus Domino anterior a 7.0.3 FP1 y 8.x anterior al 8.0.1, permite a usuarios autenticados remotamente inyectar secuencias de comandos web y HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/30310 http://secunia.com/advisories/30332 http://www-1.ibm.com/support/docview.wss?uid=swg21303296 http://www.securityfocus.com/bid/29311 http://www.vupen.com/english/advisories/2008/1597 https://exchange.xforce.ibmcloud.com/vulnerabilities/42553 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 96%CPEs: 3EXPL: 3CVE-2008-2499 – IBM Lotus Sametime Community Services Multiplexer Stack Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2008-2499
Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code via a crafted URL. Desbordamiento de búfer basado en pila en el Community Services Multiplexer (también conocido como MUX o StMux.exe) de IBM Lotus Sametime 7.5.1 CF1 y anteriores, y 8.x anterior a 8.0.1, permite a atacantes remotos ejecutar código de su elección mediante una URL manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Sametime. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of long URLs in the Community Services Multiplexer (StMux.exe) listening on TCP port 1533. A specially crafted URL can be passed into a vulnerable sscanf() function that will result in a stack overflow resulting in the ability to execute arbitrary code. • https://www.exploit-db.com/exploits/31820 https://www.exploit-db.com/exploits/16696 http://secunia.com/advisories/30309 http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21303920 http://www.securityfocus.com/bid/29328 http://www.securitytracker.com/id?1020093 http://www.vupen.com/english/advisories/2008/1595/references http://www.zerodayinitiative.com/advisories/ZDI-08-028 https://exchange.xforce.ibmcloud.com/vulnerabilities/42575 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2163
https://notcve.org/view.php?id=CVE-2008-2163
Cross-site scripting (XSS) vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors." Vulnerabilidad de Secuencias de comandos en sitios cruzados en IBM Lotus Quickr 8.1 versiones anteriores al Hotfix 5 para Windows y AIX, y anteriores al Hotfix 3 para i5/OS, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores desconocidos, relacionada con "editores WYSIWYG." • http://secunia.com/advisories/30204 http://www-01.ibm.com/support/docview.wss?uid=swg27013341 http://www-1.ibm.com/support/docview.wss?uid=swg24018711 http://www.securityfocus.com/bid/29175 http://www.vupen.com/english/advisories/2008/1502/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42360 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 92%CPEs: 3EXPL: 3CVE-2008-1965 – IBM Lotus Expeditor 6.1 - URI Handler Command Execution
https://notcve.org/view.php?id=CVE-2008-1965
Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a -launcher option via a cai: URI, as demonstrated by a reference to a UNC share pathname. Una vulnerabilidad de inyección de argumento en el manejador del URI CAI: en rcplauncher en IBM Lotus Expeditor Client for Desktop versiones 6.1.1 y 6.1.2, tal como es usado Lotus Symphony y posiblemente otros productos, permite a atacantes remotos ejecutar código arbitrario inyectando una opción -launcher por medio de un URI cai:, como es demostrado mediante una referencia hacia un nombre de ruta (path) compartido UNC. • https://www.exploit-db.com/exploits/31706 http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0640.html http://secunia.com/advisories/29958 http://thomas.pollet.googlepages.com/lotusexpeditorurihandlervulnerability http://www-1.ibm.com/support/docview.wss?uid=swg21303813 http://www.securityfocus.com/archive/1/491343/100/0/threaded http://www.securityfocus.com/bid/28926 http://www.securitytracker.com/id?1019951 http://www.securitytracker.com/id?1019952 http://www.vupen.com/english • CWE-94: Improper Control of Generation of Code ('Code Injection') •