IBM Lotus Inotes vulnerabilities

21 CVEs affecting IBM Lotus Inotes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-0282, published 2016-11-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-2175, published 2012-06-20. High severity, CVSS 9.3. EPSS: 29.4% chance of exploitation in the next 30 days. Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long…
CVE-2010-0919, published 2010-03-03. High severity, CVSS 7.6. EPSS: 5.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Lotus Domino Web Access ActiveX control in IBM Lotus iNotes (aka Domino Web Access or DWA) 6.5, 7.0 before 7.0.4, 8.0, 8.0.2, and before 229.281 for Domino 8.0.2…
CVE-2013-4068, published 2013-09-20. High severity, CVSS 7.1. EPSS: 4% chance of exploitation in the next 30 days. Buffer overflow in iNotes in IBM Domino 8.5.3 before FP5 IF1 and 9.0 before IF4 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka SPR PTHN9ADPA8.
CVE-2010-0918, published 2010-03-03. High severity, CVSS 10.0. EPSS: 2.1% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the UltraLite functionality in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.281 for Domino 8.0.2 FP4 have unknown impact and attack vectors.
CVE-2014-0913, published 2014-05-09. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM iNotes and Domino 8.5.3 FP6 before IF2 and 9.0.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via an e-mail message, aka…
CVE-2010-0276, published 2010-01-09. High severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Try Lotus iNotes anyway" link from the page that reports use of an…
CVE-2010-0275, published 2010-01-09. High severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle script commands in the status-alerts URL, which has unspecified impact…
CVE-2010-0274, published 2010-01-09. High severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the Edit Contact scene in Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 has unknown impact and attack vectors,…
CVE-2009-4594, published 2010-01-09. High severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.131 for Domino 8.0.x has unknown impact and attack vectors, aka SPR SDOY7RHBNH.
CVE-2013-0595, published 2013-08-27. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka…

Latest

CVE-2016-0282, published 2016-11-24. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 FP6 IF2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYHAAHNUS.
CVE-2013-4065, published 2013-12-21. Low severity, CVSS 2.6. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web…
CVE-2013-4064, published 2013-12-21. Low severity, CVSS 2.1. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote authenticated users to inject arbitrary…
CVE-2013-4063, published 2013-12-21. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via active content in an…
CVE-2013-0591, published 2013-08-27. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka…
CVE-2013-0590, published 2013-08-27. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka…
CVE-2013-0536, published 2013-06-21. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that…