Unscored severity · published Oct 18, 2004
CVE-2004-1621
NOTE: this issue has been disputed by the vendor
–
CVSS
3.1%
EPSS
No
On KEV
Description
NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields. NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LD
Lotus Domino · Ibm
6.0; 6.0.1; 6.0.2; 6.0.2_cf2; 6.0.3; 6.5.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1621
marc.info
http://marc.info/?l=bugtraq&m=109812960023736&w=2
marc.info
http://marc.info/?l=bugtraq&m=109841682529328&w=2
Exploit
http://secunia.com/advisories/12891
Exploit
http://securitytracker.com/id?1011779
Exploit
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833
US Government Resource
http://www.kb.cert.org/vuls/id/404382
More from Lotus Domino
7.8
CVE-2007-5544
IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for memory mapped files…
–
CVE-2014-3086
Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain…
–
CVE-2014-0913
Cross-site scripting (XSS) vulnerability in IBM iNotes and Domino 8.5.3 FP6 before IF2 and 9.0.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via an…
–
CVE-2014-0892
IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it easier for remote attackers to execute…
–
CVE-2014-0822
The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors,…