Secunia

Multiple vulnerabilities and security issues have been reported in IBM Lotus Connections. Some have an unknown impact and others can be exploited by malicious, local users to disclose sensitive information and by malicious people to disclosure sensitive information, conduct cross-site scripting, script insertion, and SQL injection attacks.

1) Input to unspecified parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in the following components:
* Homepage
* Blogs
* Profiles
* Dogear
* Activities feed and RTE usage from Forum
* Global Search

4) Input passed via the community title is not properly sanitised before being used, this can potentially be exploited to execute arbitrary HTML and script code in the user's browser session in context of an affected site.

3) Input passed via the API is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is viewed.

4) Input passed via the "sortField" parameter to unspecified scripts is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

5) A security issue is caused due to the administrative user's password being stored within "trace.log".

6) Two security issues are caused due to unspecified password leaks.

7) Various unspecified vulnerabilities related to Active content exist in Profiles search pages.

Solution
Update to version 2.0.1.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
IBM (ASRE7FPNBE, ASRE7FWNT2, ASRE7FWPZ8, ASRE7H3HXG, ASRE7JBMS6, ASRE7K2RUP, PMAN7JJGD6, BSTL7K7L8Z, RSUN7JTB94, AKON7FWM2W, AKON7JEKFR, YYCG7GZDAU, YYCG7H84LH, MAHN7FWK9C):
http://www-01.ibm.com/support/docview.wss?uid=swg27014008

Deep Links
Links available in Customer Area