IBM Lotus Sametime vulnerabilities

18 CVEs affecting IBM Lotus Sametime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-3985, published 2013-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-2499, published 2008-05-29. High severity, CVSS 7.5. EPSS: 77.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.x before 8.0.1, allows remote attackers to execute…
CVE-2013-3986, published 2013-11-08. Medium severity, CVSS 4.3. EPSS: 9.3% chance of exploitation in the next 30 days. IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session.
CVE-2007-1784, published 2007-03-31. High severity, CVSS 9.3. EPSS: 3.5% chance of exploitation in the next 30 days. The JNILoader ActiveX control (STJNILoader.ocx) 3.1.0.26 in IBM Lotus Notes Sametime before 7.5 allows remote attackers to load arbitrary DLL libraries and execute arbitrary code via arbitrary…
CVE-2011-1038, published 2011-02-22. Medium severity, CVSS 4.3. EPSS: 3.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in stconf.nsf in the server in IBM Lotus Sametime 8.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the messageString…
CVE-2008-0354, published 2008-01-18. Medium severity, CVSS 4.3. EPSS: 2.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the chat client in IBM Lotus Sametime 7.5 and 7.5.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted message,…
CVE-2011-1106, published 2011-03-01. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an…
CVE-2010-3398, published 2010-09-15. High severity, CVSS 10.0. EPSS: 1.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the webcontainer implementation in IBM Lotus Sametime Connect 8.5.1 before CF1 has unknown impact and attack vectors, aka SPRs LXUU87S57H and LXUU87S93W.
CVE-2007-6295, published 2007-12-10. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the WebRunMenuFrame page in the online meeting center template in IBM Lotus Sametime before 8.0 allows remote attackers to inject arbitrary web script or…
CVE-2007-4142, published 2007-08-03. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Lotus Sametime Server 7.5.1 before 20070731 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a crafted…
CVE-2011-1370, published 2011-10-29. Medium severity, CVSS 5.0. EPSS: 1.1% chance of exploitation in the next 30 days. The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote…

Latest

CVE-2013-3985, published 2013-11-09. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 does not properly restrict application cookies, which allows remote attackers to read session variables by leveraging a weak…
CVE-2013-3045, published 2013-11-09. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to share crafted links via the Library function.
CVE-2013-3044, published 2013-11-09. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of chat messages, or compose anonymous chat messages, by leveraging…
CVE-2013-0537, published 2013-11-09. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges.
CVE-2013-0534, published 2013-06-21. Low severity, CVSS 1.9. EPSS: 0.3% chance of exploitation in the next 30 days. The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging…
CVE-2013-0535, published 2013-05-02. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via…
CVE-2013-0553, published 2013-04-28. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced Connect client, Sametime Advanced Web client, and other products, allows remote…
CVE-2013-0533, published 2013-04-28. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified…