IBM Lotus Domino vulnerabilities

86 CVEs affecting IBM Lotus Domino, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-3086, published 2014-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2005-2428, published 2005-08-03. Medium severity, CVSS 5.0. EPSS: 73% chance of exploitation in the next 30 days. Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to…
CVE-2008-2240, published 2008-05-22. High severity, CVSS 10.0. EPSS: 64.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly…
CVE-2007-1675, published 2007-03-28. High severity, CVSS 10.0. EPSS: 61.2% chance of exploitation in the next 30 days. Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service…
CVE-2010-3407, published 2010-09-16. High severity, CVSS 9.3. EPSS: 41.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows…
CVE-2007-0977, published 2007-02-16. High severity, CVSS 7.1. EPSS: 19.9% chance of exploitation in the next 30 days. IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to…
CVE-2011-0917, published 2011-02-08. High severity, CVSS 10.0. EPSS: 14.3% chance of exploitation in the next 30 days. Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in an LDAP Bind operation, aka SPR KLYH87LMVX.
CVE-2011-0915, published 2011-02-08. High severity, CVSS 10.0. EPSS: 11.6% chance of exploitation in the next 30 days. Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes…
CVE-2011-3575, published 2011-09-19. High severity, CVSS 9.0. EPSS: 10.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute arbitrary code via a long tHPRAgentName…
CVE-2011-0920, published 2011-02-08. High severity, CVSS 9.3. EPSS: 10.2% chance of exploitation in the next 30 days. The Remote Console in IBM Lotus Domino, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and execute arbitrary code via…
CVE-2003-0122, published 2003-03-18. Medium severity, CVSS 5.0. EPSS: 10.1% chance of exploitation in the next 30 days. Buffer overflow in Notes server before Lotus Notes R4, R5 before 5.0.11, and early R6 allows remote attackers to execute arbitrary code via a long distinguished name (DN) during NotesRPC…

Latest

CVE-2014-3086, published 2014-08-12. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by…
CVE-2014-0913, published 2014-05-09. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM iNotes and Domino 8.5.3 FP6 before IF2 and 9.0.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via an e-mail message, aka…
CVE-2014-0892, published 2014-04-23. Medium severity, CVSS 5.0. EPSS: 4.2% chance of exploitation in the next 30 days. IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by…
CVE-2014-0822, published 2014-02-06. High severity, CVSS 7.8. EPSS: 1.8% chance of exploitation in the next 30 days. The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, aka SPR KLYH9F4S2Z.
CVE-2013-4065, published 2013-12-21. Low severity, CVSS 2.6. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web…
CVE-2013-4064, published 2013-12-21. Low severity, CVSS 2.1. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary…
CVE-2013-4063, published 2013-12-21. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via active content in an…
CVE-2013-4055, published 2013-11-08. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified…
CVE-2013-4051, published 2013-11-08. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified…
CVE-2013-4050, published 2013-11-08. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in webadmin.nsf in Domino Web Administrator in IBM Domino 8.5 and 9.0 allows remote authenticated users to hijack the authentication of unspecified…