Description
NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier versions, allows remote attackers to execute arbitrary web script or HTML via square brackets at the beginning and end of (1) computed for display, (2) computed when composed, or (3) computed text element fields. NOTE: the vendor has disputed this issue, saying that it is not a problem with Notes/Domino itself, but with the applications that do not properly handle this feature
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Juan C Calderon · textwebappsunix
https://www.exploit-db.com/exploits/24690
References (8)
Core 8
Core References
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/404382
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/17758
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=109841682529328&w=2
Exploit, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/12891
Exploit, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/11458
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=109812960023736&w=2
Exploit, Vendor Advisory vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1011779
Exploit, Vendor Advisory x_refsource_misc
http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21187833
Scores
EPSS
0.0401
EPSS Percentile
88.6%
Details
Status
published
Products (8)
ibm/lotus_domino
6.0
ibm/lotus_domino
6.0.1
ibm/lotus_domino
6.0.2
ibm/lotus_domino
6.0.2_cf2
ibm/lotus_domino
6.0.3
ibm/lotus_domino
6.5.0
ibm/lotus_domino
6.5.1
ibm/lotus_domino
6.5.2
Published
Oct 18, 2004
Tracked Since
Feb 18, 2026