This host is running Lotus Domino HTTP Server and is prone to multiple vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary HTML or web script in a user's browser session in context of an affected site, compromise the application and access web server configuration information. Impact Level: Application

Update to IBM Lotus Domino 8.5.4 or later, For updates refer to http://www-142.ibm.com/software/products/us/en/ibmdomino

- Input appended to the URL after servlet/ is not properly sanitized before being returned to the user. - Input passed via the 'Src' parameter to MailFS and WebInteriorMailFS is not properly sanitized before being returned to the user. - Input passed via the 'RedirectTo' parameter to names.nsf?Login is not properly sanitized before being returned to the user. - The 'domcfg.nsf' page is accessible without authentication, there is a leakage of information about web server configuration.

IBM Lotus Domino 7.x and 8.x before 8.5.4

• http://osvdb.org/84768
• http://seclists.org/fulldisclosure/2012/Sep/55
• http://secunia.com/advisories/50330
• http://securityvulns.ru/docs28474.html
• http://www-01.ibm.com/support/docview.wss?uid=swg21608160
• http://www-01.ibm.com/support/docview.wss?uid=swg21614077
• http://xforce.iss.net/xforce/xfdb/77401
• http://xforce.iss.net/xforce/xfdb/79233

---

Updated on 2015-03-25