CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6594
https://notcve.org/view.php?id=CVE-2007-6594
IBM Lotus Notes 8 for Linux before 8.0.1 uses (1) unspecified weak permissions for the installation kit obtained through a Notes 8 download and (2) 0777 permissions for the installdata file that is created by setup.sh, which allows local users to gain privileges via a Trojan horse file. IBM Lotus Notes 8 para Linux anterior a 9.0.1 usa (1) permisos débiles no especificados para el kit de instalación obtenido a través de la descarga de Notes 8 y (2) permisos 0777 para el archivo installdata que crea setup.sh, lo cual permite a usuarios locales obtener privilegios mediante un archivo troyano (Trojan horse file). • http://osvdb.org/40933 http://osvdb.org/40934 http://secunia.com/advisories/27860 http://securitytracker.com/id?1019009 http://www-1.ibm.com/support/docview.wss?uid=swg21289273 http://www.vupen.com/english/advisories/2007/4037 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 10%CPEs: 5EXPL: 1CVE-2007-6593 – Autonomy KeyView Lotus 1-2-3 - File Multiple Buffer Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-6593
Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK, as used by IBM Lotus Notes 5.x through 8.x, allow user-assisted remote attackers to execute arbitrary code via the (1) Length and (2) Value fields for certain Types in a Lotus 1-2-3 (.123) file in the Worksheet File (WKS) format, as demonstrated by a file with a crafted SRANGE record, a different vulnerability than CVE-2007-5909. Múltiples desbordamientos de búfer basado en pila en l123sr.dll de Autonomy (anteriormente Verity) KeyView SDK, usado por IBM Lotus Notes 5.x hasta 8.x, permiten a atacantes remotos con la intervención del usuario ejecutar código de su elección a través de los campos (1) Length y (2) Value para determinados tipos (Types en un archivo Lotus 1-2-3 (.123) en el formato Worksheet File (WKS), como se ha demostrado mediante un archivo con un registro SRANGE manipulado, una vulnerabilidad diferente de CVE-2007-5909. • https://www.exploit-db.com/exploits/30816 http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058680.html http://secunia.com/advisories/27835 http://secunia.com/advisories/27836 http://secunia.com/advisories/27849 http://securityreason.com/securityalert/3499 http://securitytracker.com/id?1019002 http://www.coresecurity.com/index.php5?action=item&id=2008 http://www.ibm.com/support/docview.wss?rs=475&uid=swg21285600 http://www.securityfocus.com/archive/1/484272/100/0&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 97%CPEs: 17EXPL: 6CVE-2007-4474 – IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-4474
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1. Múltiples desbordamientos de búfer basado en pila en el control ActiveX IBM Lotus Domino Web Access, proporcionado en inotes6.dll, inotes62.dll, dwa7.dll, y dwa7w.dll, en Domino 6.x y 7.x permiten a atacantes remotos ejecutar código de su elección, como se ha demostrado mediante un desbordamiento con un valor largo de la propiedad General_ServerName cuando se llama a la función InstallBrowserHelperDll del módulo Upload en el control dwa7.dwa7.1 de dwa7w.dll 7.0.34.1. • https://www.exploit-db.com/exploits/4818 https://www.exploit-db.com/exploits/4820 https://www.exploit-db.com/exploits/5111 https://www.exploit-db.com/exploits/16502 http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html http://osvdb.org/40954 http://secunia.com/advisories/28184 http://www.kb.cert.org/vuls/id/963889 http://www.securityfocus.com/bid/26972 http://www.securitytracker.com/id?1019138 http://www.vupen.com/english/advisories/2007&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6295
https://notcve.org/view.php?id=CVE-2007-6295
Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or HTML via the URI. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la página WebRunMenuFrame en la plantilla de centro de encuentros de IBM Lotus Sametime versiones anteriores a 8.0 permite a atacantes remotos inyectar scripts web o HTML de su elección mediante el URI. • http://osvdb.org/39258 http://secunia.com/advisories/27941 http://www-1.ibm.com/support/docview.wss?uid=sim5079c9d76e4fcf910852573a800495249 http://www.securityfocus.com/bid/26734 http://www.securitytracker.com/id?1019053 http://www.vupen.com/english/advisories/2007/4104 https://exchange.xforce.ibmcloud.com/vulnerabilities/38891 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 4%CPEs: 11EXPL: 0CVE-2007-5910
https://notcve.org/view.php?id=CVE-2007-5910
Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, wp6sr.dll in IBM Lotus Notes 8.0 and before 7.0.3, Symantec Mail Security, and other products, allows remote attackers to execute arbitrary code via a crafted WordPerfect (WPD) file. Desbordamiento de búfer basado en pila en el Autonomy (antiguamente Verity) KeyView Viewer, en el Filter y en el Export SDK anterior al 9.2.0.12, como el utilizado en el ActivePDF DocConverter, en el wp6sr.dll del IBM Lotus Notes 8.0 y anteriores al 7.0.3, en el Symantec Mail Security y en otros productos, permite a atacantes remotos ejecutar código de su elección a través de un fichero modificado de WordPerfect (WPD). • http://secunia.com/advisories/27304 http://securityreason.com/securityalert/3357 http://securityresponse.symantec.com/avcenter/security/Content/2007.11.01c.html http://securitytracker.com/id?1018853 http://securitytracker.com/id?1018886 http://vuln.sg/lotusnotes702-en.html http://vuln.sg/lotusnotes702wpd-en.html http://www-1.ibm.com/support/docview.wss?rs=899&uid=swg21271111 http://www.securityfocus.com/archive/1/482664 http://www.securityfocus.com/bid/26175 http://www.vupen.com • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •