CVE-2005-2619 json
Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7…
published 2005-12-31 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-2620
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in kvarcve.dll in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allows remote attackers to delete arbitrary files via a (1) ZIP, (2) UUE or (3) TAR archive that contains a .. (dot dot) in the filename, which is not properly handled when generating a preview.
Patch / fix
- www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229918 patch
- osvdb.org/23066 patch
- securitytracker.com/id?1015657 patch
- secunia.com/advisories/16100 advisory
- secunia.com/advisories/16280 advisory
Exploit prediction
3.28% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
www-1.ibm.com
/support/docview.wss?rs=475&uid=swg21229918
patch
-
osvdb.org
/23066
vdb-entry, patch
-
securitytracker.com
/id?1015657
vdb-entry, patch
-
secunia.com
/advisories/16100
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/16280
third-party-advisory, patch, vendor-advisory
-
secunia.com
/secunia_research/2005-30/advisory/
vendor-advisory
-
secunia.com
/secunia_research/2005-66/advisory/
vendor-advisory
-
vupen.com
/english/advisories/2006/0500
vdb-entry
-
securityfocus.com
/archive/1/424717/100/0/threaded
mailing-list
-
securityfocus.com
/bid/16576
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24637
vdb-entry
Sources
- CVE List CVE-2005-2619
- NVD CVE-2005-2619
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.