CVE-2006-5835

The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.

• http://secunia.com/advisories/22741Patch, Vendor Advisory
• http://securitytracker.com/id?1017203
• http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026Patch
• http://www.fortconsult.net/images/pdf/lotusnotes_keyfiles.pdfExploit, Vendor Advisory
• http://www.securityfocus.com/bid/20960
• http://www.vupen.com/english/advisories/2006/4411
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30118
• http://secunia.com/advisories/22741Patch, Vendor Advisory
• http://securitytracker.com/id?1017203
• http://www-1.ibm.com/support/docview.wss?rs=463&uid=swg21248026Patch
• http://www.fortconsult.net/images/pdf/lotusnotes_keyfiles.pdfExploit, Vendor Advisory
• http://www.securityfocus.com/bid/20960
• http://www.vupen.com/english/advisories/2006/4411
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30118

Published

Nov 10, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-5829Multiple SQL injection vulnerabilities in All In One Control…
• CVE-2006-5830Multiple cross-site scripting (XSS) vulnerabilities in All I…
• CVE-2006-5831PHP remote file inclusion vulnerability in admin/code/index.…
• CVE-2006-5832All In One Control Panel (AIOCP) 1.3.007 and earlier allows …
• CVE-2006-5833gbcms_php_files/up_loader.php GreenBeast CMS 1.3 does not re…
• CVE-2006-5834Directory traversal vulnerability in general.php in OpenSolu…
• CVE-2006-5836The fpathconf syscall function in bsd/kern/kern_descrip.c in…
• CVE-2006-5837Static code injection vulnerability in chat_panel.php in the…
• CVE-2006-5838PHP remote file inclusion vulnerability in lib/class.Databas…
• CVE-2006-5839PHP remote file inclusion vulnerability in ad_main.php in PH…
• CVE-2006-5840Multiple SQL injection vulnerabilities in Abarcar Realty Por…
• CVE-2006-5841Multiple PHP remote file inclusion vulnerabilities in dodosm…