154 matches found
ExchangeRelayX
ExchangeRelayX Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking...
PrivExchange
PrivExchange POC tools accompanying the blog Abusing Exchange: One API call away from Domain Admin. Requirements These tools require impacket. You can install it from pip with pip install impacket, but it is recommended to use the latest version from GitHub. privexchange.py This tool simply logs ...
Exchange2domain
Exchange2domain Herramientas todo en uno de privexchange. Solo necesitas abrir el puerto del servidor web, por lo que no se requieren privilegios elevados. ¡Gran artículo! Abusando de Exchange: una sola llamada a la API te separa de Domain Admin. Requisitos Estas herramientas requieren impacket...
CVE-2026-10631
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...
CVE-2026-10631
An authorization bypass exists in the EWS FindItem handler of Zimbra Collaboration Suite versions 10.1.0 through 10.1.19 . An authenticated user with EWS enabled can use a crafted composite folder/item identifier to read complete mailbox items, including raw MIME and attachments , from arbitrary ...
EUVD-2026-95096
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...
CVE-2026-10631 Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...
SharpExchange
SharpExchange Este POC de línea de comandos demuestra cómo se puede usar C para interactuar con Microsoft Exchange EWS, mostrando que puede hacerse con otras herramientas además de PowerShell. Sí, es un POC simple para mostrar cómo podría hacerse. No es 100%. Si quieres lucir tus habilidades l33t...
[SECURITY] Fedora 45 Update: evolution-ews-3.62.0-2.fc45
This package allows Evolution to interact with Microsoft Exchange servers, versions 2007 and later, through its Exchange Web Services EWS interface...
[SECURITY] Fedora 45 Update: evolution-ews-3.62.0-1.fc45
This package allows Evolution to interact with Microsoft Exchange servers, versions 2007 and later, through its Exchange Web Services EWS interface...
Fedora 45 : evolution / evolution-data-server / evolution-ews (2026-5debc0de2b)
The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-5debc0de2b advisory. Update to 3.62.0 evolution-data-server Bug Fixes: I660 - GOA EWS: Do not require OABUrl in autodiscover I662 - EBackend: Document how OAuth2 sources should a...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575
CVE-2026-73575 affects Zimbra Collaboration (ZCS) pre-10.1.17. A CSRF vulnerability exists in the Exchange Web Services (EWS) endpoint caused by insufficient validation of request content types. An attacker could induce an authenticated user to submit a crafted request, potentially allowing unaut...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575: Cross-Site Request Forgery (CSRF)
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
PT-2026-71681
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A Cross-Site Request Forgery CSRF issue exists due to insufficient validation of request content types. This allows an attacker to trick an authenticated user into submitting a...
