IBM Domino vulnerabilities

27 CVEs affecting IBM Domino, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-6277, published 2020-02-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0135, published 2015-04-21. High severity, CVSS 10.0. EPSS: 39.8% chance of exploitation in the next 30 days. IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of service (integer truncation and application crash) via a…
CVE-2012-6277, published 2020-02-21. High severity, CVSS 7.8. EPSS: 8.1% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for Domino before 8.1.1,…
CVE-2015-1903, published 2015-05-20. High severity, CVSS 10.0. EPSS: 7.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSN3Y.
CVE-2015-1902, published 2015-05-20. High severity, CVSS 10.0. EPSS: 7.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA.
CVE-2017-1274, published 2017-04-25. High severity, CVSS 8.8. EPSS: 6.7% chance of exploitation in the next 30 days. IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM…
CVE-2015-0134, published 2015-04-06. High severity, CVSS 10.0. EPSS: 4.7% chance of exploitation in the next 30 days. Buffer overflow in the SSLv2 implementation in IBM Domino 8.5.x before 8.5.1 FP5 IF3, 8.5.2 before FP4 IF3, 8.5.3 before FP6 IF6, 9.0 before IF7, and 9.0.1 before FP2 IF3 allows remote attackers to…
CVE-2015-0117, published 2015-04-06. High severity, CVSS 10.0. EPSS: 3.8% chance of exploitation in the next 30 days. The LDAP Server in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
CVE-2015-5040, published 2015-10-29. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash)…
CVE-2015-4994, published 2015-10-29. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash)…
CVE-2016-0270, published 2017-02-08. Medium severity, CVSS 5.9. EPSS: 3.1% chance of exploitation in the next 30 days. IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the…

Latest

CVE-2018-1771, published 2018-12-20. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687.
CVE-2016-6087, published 2017-06-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918.
CVE-2016-6113, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2016-5884, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2016-5882, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2016-5880, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2016-2939, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…