IBM » Lotus Domino » 7.0 : Security Vulnerabilities, CVEs, CVSS score >= 9
The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field. NOTE: this might overlap CVE-2011-0920.
Max CVSS
10.0
EPSS Score
7.67%
Published
2011-03-25
Updated
2018-10-09
Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes calendar (aka iCalendar or iCal) meeting request, aka SPR KLYH87LL23.
Max CVSS
10.0
EPSS Score
87.47%
Published
2011-02-08
Updated
2018-10-09
Integer signedness error in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP client request, leading to a heap-based buffer overflow.
Max CVSS
10.0
EPSS Score
24.11%
Published
2011-02-08
Updated
2011-02-23
Stack-based buffer overflow in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP getEnvironmentString request, related to the local variable cache.
Max CVSS
10.0
EPSS Score
15.19%
Published
2011-02-08
Updated
2011-02-23
Heap-based buffer overflow in the server in IBM Lotus Domino 7 and 8.5 FP1 allows remote attackers to cause a denial of service (daemon exit) and possibly have unspecified other impact via a long string in a crafted LDAP message to a TCP port, a different vulnerability than CVE-2009-3087.
Max CVSS
10.0
EPSS Score
0.39%
Published
2010-01-20
Updated
2011-04-28
CVE-2008-2240
Public exploit
Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long Accept-Language HTTP header.
Max CVSS
10.0
EPSS Score
97.07%
Published
2008-05-22
Updated
2017-08-08
Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute arbitrary code via a long mailbox name.
Max CVSS
9.0
EPSS Score
86.28%
Published
2007-10-29
Updated
2017-07-29
Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
Max CVSS
10.0
EPSS Score
92.68%
Published
2007-03-28
Updated
2017-07-29
IBM Lotus Domino 7.0.x before 7.0.3 does not revalidate the signature on a signed scheduled agent after the agent is modified, which allows remote authenticated users to gain privileges via a modified agent in a server database.
Max CVSS
9.3
EPSS Score
1.78%
Published
2007-06-06
Updated
2017-07-29
9 vulnerabilities found