IBM Inotes vulnerabilities

20 CVEs affecting IBM Inotes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1659, published 2020-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1129, published 2017-09-05. Medium severity, CVSS 6.5. EPSS: 30.1% chance of exploitation in the next 30 days. IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted. IBM X-Force ID:…
CVE-2017-1130, published 2017-09-05. Medium severity, CVSS 6.5. EPSS: 29.2% chance of exploitation in the next 30 days. IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which would cause the client hang and…
CVE-2013-0589, published 2018-07-11. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM…
CVE-2017-1214, published 2017-06-12. Medium severity, CVSS 5.7. EPSS: 1.3% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 could allow a remote attacker to send a malformed email to a victim, that when opened could cause an information disclosure. IBM X-Force ID: 123854.
CVE-2016-9990, published 2017-03-31. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2013-0594, published 2018-07-11. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified…
CVE-2016-5883, published 2017-02-23. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2017-1421, published 2017-12-13. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2017-1332, published 2017-07-31. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2017-1327, published 2017-08-03. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…

Latest

CVE-2017-1659, published 2020-07-01. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. "HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."
CVE-2013-0592, published 2018-07-11. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force…