{"schemaVersion":3,"id":"CVE-2007-4474","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7w.dll, in Domino 6.x and 7.x allow remote attackers to execute arbitrary code, as demonstrated by an overflow from a long General_ServerName property value when calling the InstallBrowserHelperDll function in the Upload Module in the dwa7.dwa7.1 control in dwa7w.dll 7.0.34.1.","dates":{"published":"2007-12-27T22:00:00.000Z","modified":"2024-08-07T14:53:55.977Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.44184,"percentile":0.98753,"severity":"high","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.44184},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.44184,"percentile":0.98753}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.44184,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.44184,"percentile":0.98753}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_7B34BAE5E971F241","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/26972","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_40FF0AD4B8675631","name":"Exploit Reference (lists.grok.org.uk)","source":"reference","url":"http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"4818","name":"IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/4818","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/4818.html","codes":["OSVDB-51568","CVE-2007-4474"]},"metasploit":null},{"id":"4820","name":"IBM Domino Web Access Upload Module - 'dwa7w.dll' Remote Buffer Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/4820","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/4820.html","codes":["CVE-2007-4474","OSVDB-40954"]},"metasploit":null},{"id":"5111","name":"IBM Domino Web Access Upload Module - Overwrite (SEH)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/5111","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/5111.html","codes":["CVE-2007-4474"]},"metasploit":null},{"id":"16502","name":"IBM Lotus Domino Web Access Upload Module - Remote Buffer Overflow (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16502","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16502.rb","codes":["CVE-2007-4474","OSVDB-40954"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BROWSER_IBMLOTUSDOMINO_DWA_UPLOADMODULE","name":"IBM Lotus Domino Web Access Upload Module Buffer Overflow","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/browser/ibmlotusdomino_dwa_uploadmodule.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/browser/ibmlotusdomino_dwa_uploadmodule","rank":"300","rankName":"normal","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":7,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"ibm","product":"domino_web_access","name":"domino web access","label":"domino_web_access","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0.1.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0.2","noFixRecorded":false,"fixedIn":null},{"text":"6.0.3","noFixRecorded":false,"fixedIn":null},{"text":"6.0.4","noFixRecorded":false,"fixedIn":null},{"text":"6.0.5","noFixRecorded":false,"fixedIn":null},{"text":"6.5","noFixRecorded":false,"fixedIn":null},{"text":"6.5.1","noFixRecorded":false,"fixedIn":null},{"text":"6.5.2","noFixRecorded":false,"fixedIn":null},{"text":"6.5.3","noFixRecorded":false,"fixedIn":null},{"text":"6.5.4","noFixRecorded":false,"fixedIn":null},{"text":"6.5.5","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"7.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0 | 6.0.1 | 6.0.1.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 6.5 | 6.5.1 | 6.5.2 | 6.5.3 | 6.5.4 | 6.5.5 | 7.0 | 7.0.1","eol":null,"hubHref":"/vendor/ibm/domino_web_access"},{"vendor":"ibm","product":"lotus_domino_web_access","name":"lotus domino web access","label":"lotus_domino_web_access","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0.1","noFixRecorded":false,"fixedIn":null},{"text":"7.0.34.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0.1 | 7.0.34.1","eol":null,"hubHref":"/vendor/ibm/lotus_domino_web_access"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id?1019138","label":"www.securitytracker.com/id?1019138","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/5111","label":"www.exploit-db.com/exploits/5111","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"http://www.securityfocus.com/bid/26972","label":"www.securityfocus.com/bid/26972","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Exploit"]},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html","label":"lists.grok.org.uk/pipermail/full-disclosure/2007-December/059233.html","hostname":"lists.grok.org.uk","tags":["Mailing List","X Refsource FULLDISC","Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39175","label":"exchange.xforce.ibmcloud.com/vulnerabilities/39175","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"https://www.exploit-db.com/exploits/4820","label":"www.exploit-db.com/exploits/4820","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"http://www.kb.cert.org/vuls/id/963889","label":"www.kb.cert.org/vuls/id/963889","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2007/4296","label":"www.vupen.com/english/advisories/2007/4296","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/28184","label":"secunia.com/advisories/28184","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/4818","label":"www.exploit-db.com/exploits/4818","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"http://osvdb.org/40954","label":"osvdb.org/40954","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-12-27T22:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T14:53:55.977Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T14:50:14.827Z","stale":false,"partial":false}}