CVE-2004-0480

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=108843896506099&w=2Third Party Advisory
http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510Broken Link, Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilitiesBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/10600Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16496Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=108843896506099&w=2Third Party Advisory
http://www-1.ibm.com/support/docview.wss?rs=475/context=SSKTWP&uid=swg21169510Broken Link, Patch, Vendor Advisory
http://www.idefense.com/application/poi/display?id=111&type=vulnerabilitiesBroken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/10600Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16496Third Party Advisory, VDB Entry

Timeline

Published: Dec 6, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-04812.1The logging feature in kcms_configure in the KCMS package on Solaris 8 and 9, and possibly other versions, allows local users to corrupt arb CVE-2004-04824.6Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6)CVE-2004-04835.0Unknown vulnerability in rpc.mountd for SGI IRIX 6.5.24 allows remote attackers to cause a denial of service (infinite loop) via certain RPC CVE-2004-04842.6mshtml.dll in Microsoft Internet Explorer 6.0.2800 allows remote attackers to cause a denial of service (crash) via a table containing a for CVE-2004-04855.0The default protocol helper for the disk: URI on Mac OS X 10.3.3 and 10.2.8 allows remote attackers to write arbitrary files by causing a di CVE-2004-04867.6HelpViewer in Mac OS X 10.3.3 and 10.2.8 processes scripts that it did not initiate, which can allow attackers to execute arbitrary code, an CVE-2004-048710.0A certain ActiveX control in Symantec Norton AntiVirus 2004 allows remote attackers to cause a denial of service (resource consumption) and CVE-2004-04887.5Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust t CVE-2004-04897.6Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbit CVE-2004-04907.2cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php CVE-2004-04912.1The linux-2.4.21-mlock.patch in Red Hat Enterprise Linux 3 does not properly maintain the mlock page count when one process unlocks pages th CVE-2004-049210.0Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (pr