3051 matches found
Microsoft Exchange Server Arbitrary File Write Vulnerability
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server Arbitrary File Write Vulnerability. An attacker can exploit this vulnerability to write a file to any path on the server after authenticating through the Exchang...
Microsoft Exchange Server Deserialization Vulnerability
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server deserialization vulnerability, which requires administrator privileges, can be exploited by an attacker to be able to run code as SYSTEM on Exchange Server...
Microsoft Exchange Server Request Forgery Vulnerability
Exchange is a messaging and collaboration system that is a suite of e-mail service components from Microsoft. Microsoft Exchange Server request forgery vulnerability can be exploited by an attacker to be able to send arbitrary HTTP requests and authenticate with Exchange Server...
CVE-2021-26855
Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: wvu-r7 at March 09, 2021 7:01am UTC reported: CVE-2021-26855 CVE-2021-26855 is an SSRF vulnerability in Exchange that allows privileged access to Exchange’s backend resources, ultimately leading to pre-auth RCE when...
CVE-2021-26857
Microsoft Exchange Server Remote Code Execution Vulnerability Recent assessments: wvu-r7 at March 03, 2021 6:59pm UTC reported: As per Microsoft’s blog post on Exchange Server 0day use by the HAFNIUM actors, CVE-2021-26857 is a deserialization vulnerability in Exchange Server’s Unified Messaging...
The vulnerability of Microsoft Exchange Server servers, related to insufficient validation of incoming requests, allows attackers to execute SSRF attacks.
The vulnerability of Microsoft Exchange Server lies in the insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using specially crafted HTTPS requests that contain malicious cookie files named X-AnonResource-Backend and...
Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-14768)
Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...
Microsoft Exchange Server Remote Code Execution Vulnerability (CNVD-2021-14769)
Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker could exploit this vulnerability to achieve remote code execution...
CVE-2021-27078 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-27065 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-27065 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26858 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26858 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26855
CVE-2021-26855 is an Exchange Server SSRF vulnerability that enables pre-auth access to Exchange backend and, when chained with CVE-2021-27065, can lead to remote code execution. Public exploitation activity and PoCs (e.g., Nmap http-vuln-cve2021-26855 scripts and curl demonstrations) illustrate ...
CVE-2021-26855 Microsoft Exchange Server Remote Code Execution Vulnerability
...
CVE-2021-26857
CVE-2021-26857 is an on‑premises Microsoft Exchange Server remote code execution vulnerability in the Unified Messaging deserialization path. The issue involves insecure deserialization of header data (ContactInfo) within voicemail processing, where an attacker could craft a Base64-encoded header...