IBM Lotus Notes vulnerabilities

71 CVEs affecting IBM Lotus Notes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-0522, published 2018-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2002-0370, published 2002-10-10. High severity, CVSS 7.5. EPSS: 43.3% chance of exploitation in the next 30 days. Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames,…
CVE-2012-2174, published 2012-06-20. High severity, CVSS 9.3. EPSS: 38.3% chance of exploitation in the next 30 days. The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVE-2011-1213, published 2011-05-31. High severity, CVSS 9.3. EPSS: 33% chance of exploitation in the next 30 days. Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that…
CVE-2007-5909, published 2007-11-10. High severity, CVSS 9.3. EPSS: 20.9% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, IBM Lotus Notes before 7.0.3, Symantec…
CVE-2006-5835, published 2006-11-10. Medium severity, CVSS 5.0. EPSS: 13.4% chance of exploitation in the next 30 days. The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers…
CVE-2004-2280, published 2004-12-31. Medium severity, CVSS 5.0. EPSS: 8.7% chance of exploitation in the next 30 days. Buffer overflow in IBM Lotus Notes 6.5.x before 6.5.3 and 6.0.x before 6.0.5 allows remote attackers to cause a denial of service (crash) via unknown vectors related to Java applets, as identified by…
CVE-2004-0480, published 2004-12-06. High severity, CVSS 10.0. EPSS: 8.6% chance of exploitation in the next 30 days. Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate…
CVE-2005-2618, published 2005-12-31. High severity, CVSS 9.3. EPSS: 7.9% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allow remote attackers to execute arbitrary code via (1) a UUE file…
CVE-2012-4822, published 2013-01-11. High severity, CVSS 9.3. EPSS: 6.9% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and…
CVE-2012-4821, published 2013-01-11. High severity, CVSS 9.3. EPSS: 6.9% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and…

Latest

CVE-2013-0522, published 2018-07-16. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving an unspecified…
CVE-2014-3086, published 2014-08-12. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by…
CVE-2014-0892, published 2014-04-23. Medium severity, CVSS 5.0. EPSS: 4.2% chance of exploitation in the next 30 days. IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute arbitrary code by…
CVE-2012-6349, published 2013-07-18. High severity, CVSS 9.3. EPSS: 3.2% chance of exploitation in the next 30 days. Buffer overflow in the .mdb parser in Autonomy KeyView IDOL, as used in IBM Notes 8.5.x before 8.5.3 FP4, allows remote attackers to execute arbitrary code via a crafted file, aka SPR KLYH92XL3W.
CVE-2013-0536, published 2013-06-21. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that…
CVE-2013-2977, published 2013-05-10. Medium severity, CVSS 6.8. EPSS: 4.7% chance of exploitation in the next 30 days. Integer overflow in IBM Notes 8.5.x before 8.5.3 FP4 Interim Fix 1 and 9.x before 9.0 Interim Fix 1 on Windows, and 8.5.x before 8.5.3 FP5 and 9.x before 9.0.1 on Linux, allows remote attackers to…
CVE-2013-0538, published 2013-05-01. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT…
CVE-2013-0127, published 2013-05-01. Medium severity, CVSS 5.8. EPSS: 3.8% chance of exploitation in the next 30 days. IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java…
CVE-2012-4823, published 2013-01-11. High severity, CVSS 9.3. EPSS: 6.9% chance of exploitation in the next 30 days. Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used…