K73644551: Apache Tomcat vulnerability CVE-2016-6325

Security Advisory Description The Tomcat package on Red Hat Enterprise Linux RHEL 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for 1 /etc/sysconfig/tomcat and 2 /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat...

SUSE CVE-2019-3890

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference...

Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: March 14, 2023 (KB5024296)

None None...

evolution-ews bug fix and enhancement update

An update is available for evolution-ews. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linu...

Microsoft Exchange Server Remote Code Execution (CVE-2022-23277)

A remote code execution vulnerability exists in Microsoft Exchange Server. The vulnerability is due to improper handling of EWS requests containing malicious UserConfiguration objects...

evolution-ews bug fix and enhancement update

An update is available for evolution-ews. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The evolution-ews package allows Evolution to interact with Microsoft...

CVE-2022-30072

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting XSS via \admin\pages\sectionssave.php namesection2 parameters...

Exploit for Server-Side Request Forgery in Microsoft

pocproxylogon Microsoft Exchange ProxyLogon PoC CVE-2021-268...

evolution, evolution-data-server, evolution-ews bug fix and enhancement update

An update is available for evolution, evolution-ews, evolution-mapi, evolution-data-server. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed...

evolution, evolution-data-server, evolution-ews bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

PST, Want a Shell? ProxyShell Exploiting Microsoft Exchange Servers

In August 2021, Mandiant Managed Defense identified and responded to the exploitation of a chain of vulnerabilities known as ProxyShell. The ProxyShell vulnerabilities consist of three CVEs CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 affecting the following versions of on-premises Microsoft...

evolution security, bug fix, and enhancement update

An update is available for evolution, evolution-ews, evolution-data-server. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Evolution is a GNOME application that...

openSUSE: Security Advisory for evolution-data-server (openSUSE-SU-2021:0482-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : evolution-data-server (openSUSE-2021-482)

This update for evolution-data-server fixes the following issues : - CVE-2020-16117: Fix crash on malformed server response with minimal capabilities bsc1174712. - CVE-2020-14928: Response injection via STARTTLS in SMTP and POP3 bsc1173910. - Fix buffer overrun when parsing base64 data bsc1182882...

[SECURITY] Fedora 34 Update: evolution-ews-3.39.3-1.fc34

This package allows Evolution to interact with Microsoft Exchange servers, versions 2007 and later, through its Exchange Web Services EWS interface...

Fedora: Security Advisory for evolution-ews (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CentOS 8 : evolution (CESA-2019:3699)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3699 advisory. - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome- online-accounts CVE-2019-3890 Note that Nessus has no...

Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452

UPDATE Oct. 28, 2021: Mandiant has recently observed targeted threat actors using EWS impersonation via the ApplicationImpersonation role to maintain persistent access to mailboxes in victim environments. Once the threat actor has access to this role, its abuse is hard to detect and provides the...

CVE-2016-8735

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

CVE-2020-17144

Microsoft Exchange Remote Code Execution Vulnerability Recent assessments: cnotin at December 10, 2020 12:16am UTC reported: Require access to OWA EWS, authenticated with password or NTLM hash Deserialization bug Only concerns Exchange 2010 because the vulnerable feature is missing from later...