CVSS: 8.5EPSS: 0%CPEs: 16EXPL: 0CVE-2013-0487
https://notcve.org/view.php?id=CVE-2013-0487
The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN. La Java Console en IBM Domino 8.5.x, permite a usuarios autenticados remotamente secuestrar credenciales temporalmente aprovechando el conocimiento sobre los detalles de los archivos de configuración. Aka aka SPR KLYH8TNNDN. • http://www-01.ibm.com/support/docview.wss?uid=swg21627597 https://exchange.xforce.ibmcloud.com/vulnerabilities/81852 • CWE-287: Improper Authentication •
CVSS: 6.0EPSS: 0%CPEs: 16EXPL: 0CVE-2013-0489
https://notcve.org/view.php?id=CVE-2013-0489
Cross-site request forgery (CSRF) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote authenticated users to hijack the authentication of administrators. Vulnerabilidad CSRF en webadmin.nsf (Aka el cliente Web Administrator) en IBM Domino 8.5.x, permite a usuarios autenticados remotamente secuestrar la autenticación de los administradores. • http://www-01.ibm.com/support/docview.wss?uid=swg21627597 https://exchange.xforce.ibmcloud.com/vulnerabilities/81854 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-4844
https://notcve.org/view.php?id=CVE-2012-4844
Cross-site scripting (XSS) vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el servidor web de IBM Lotus Domino v8.5.x través de v8.5.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21614077 https://exchange.xforce.ibmcloud.com/vulnerabilities/79233 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 14EXPL: 0CVE-2012-4842
https://notcve.org/view.php?id=CVE-2012-4842
Open redirect vulnerability in the web server in IBM Lotus Domino 8.5.x through 8.5.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de redirección abierta en el servidor web de IBM Lotus Domino v8.5.x hasta v8.5.3 que permite a atacantes remotos para redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21614077 https://exchange.xforce.ibmcloud.com/vulnerabilities/79232 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 12%CPEs: 128EXPL: 0CVE-2012-4821 – JDK: getDeclaredMethods() and setAccessible() code execution
https://notcve.org/view.php?id=CVE-2012-4821
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods. Múltiples vulnerabilidades no especificadas en el componente JRE en IBM Java 7 SR2 y anteriores, Java v6.0.1 SR3 y anteriores, Java 6 SR11 y anteriores, Java 5 SR14 y anteriores, y Java 142 SR13 FP13 y anteriores; como las usadas en IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control v5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, y Service Deliver Manager; y otros productos de otros vendedores como Red Hat, permite a atacantes remotos a ejecutar código través de vectores relacionados con "uso inseguro" de métodos (1) java.lang.Class getDeclaredMethods o (2) java.lang.reflect.AccessibleObject setAccessible(). • http://rhn.redhat.com/errata/RHSA-2012-1467.html http://seclists.org/bugtraq/2012/Sep/38 http://secunia.com/advisories/51326 http://secunia.com/advisories/51634 http://www-01.ibm.com/support/docview.wss?uid=swg1IV29659 http://www-01.ibm.com/support/docview.wss?uid=swg21615705 http://www-01.ibm.com/support/docview.wss?uid=swg21615800 http://www-01.ibm.com/support/docview.wss?uid=swg21616490 http://www-01.ibm.com/support/docview.wss? •