CVE-2020-14258: vulnerability in HCL Notes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Notes can crash or freeze when it receives a specially-crafted email message. An attacker can send this malicious email to any user, causing their email client to stop responding without needing to be logged in.
The vulnerability exists in improper input validation for email message processing in HCL Notes versions 9, 10, and 11. A remote unauthenticated attacker can craft a malicious email that triggers a denial of service condition, causing the client to hang. The attack vector is network-based and requires no authentication or user interaction beyond receiving the email.
In the same product, most dangerous first.