IBM Notes vulnerabilities

12 CVEs affecting IBM Notes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-6277, published 2020-02-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-6277, published 2020-02-21. High severity, CVSS 7.8. EPSS: 8.1% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for Domino before 8.1.1,…
CVE-2017-17689, published 2018-05-16. Medium severity, CVSS 5.9. EPSS: 4.2% chance of exploitation in the next 30 days. The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2016-0270, published 2017-02-08. Medium severity, CVSS 5.9. EPSS: 3.1% chance of exploitation in the next 30 days. IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the…
CVE-2018-1435, published 2018-03-14. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in…
CVE-2018-1437, published 2018-03-14. High severity, CVSS 7.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability…
CVE-2017-1711, published 2018-02-13. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532.
CVE-2018-1771, published 2018-12-20. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687.
CVE-2017-1720, published 2018-02-13. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807.
CVE-2018-1410, published 2018-02-19. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could…
CVE-2018-1411, published 2018-02-19. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could…

Latest

CVE-2018-1409, published 2018-02-19. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command line sent via the shared memory IPC, which could…
CVE-2017-1714, published 2018-02-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633.