3088 matches found
ExchangeSmash
proxylogon my exploit for the proxylogon chain Microsoft Exchange Server - CVE-2021-26855 Run: the exploit uses Impacket package, to install it run this: root@kitploit: user@host:$ python3 -m pip install impacket then clone the exploit repo, and enter the exploit directory: root@kitploit:...
CVE-2021-26855
CVE-2021-26855 CVE-2021-26855 ssrf Aprovechamiento simple Práctica de golang Versiones afectadas Exchange Server 2013 anteriores a CU23 Exchange Server 2016 anteriores a CU18 Exchange Server 2019 anteriores a CU7 Condiciones de explotación Esta vulnerabilidad es diferente de las anteriores...
CVE-2021-26855-PoC
CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. CVE-2021-26855 ssrf simple use of golang exercises Affected version root@kitploit: Exchange Server 2013 is less than CU23 Exchange Server 2016 is less than CU18 Exchange Server 201...
CVE-2021-24085
Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability This is a Proof of Concept for CVE-2021-24085. 1. poc.py downloads the targets cert file with private key inside 2. YellowCanary generates the msExchEcpCanary csrf token for a specific user...
CVE-2021-26855
CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. The original repo was deleted shortly after additional features user enumeration etc. were added. Please post a pull request, if you have the latest version. CVE-2021-26855 ssrf...
Vulnerabilities in Microsoft Exchange servers
Microsoft has identified 9 vulnerabilities in Exchange Server. A malicious individual can exploit these vulnerabilities to carry out Denial-of-Service attacks, impersonate other users, gain elevated privileges, execute arbitrary code, and/or access sensitive data. The most severe vulnerability,...
CVE-2026-69641
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-69382
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network...
CVE-2026-69378
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network...
CVE-2026-69380
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-69361
Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network...
CVE-2026-69355
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...
CVE-2026-55007
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network...
CVE-2026-69641
CVE-2026-69641 is a missing authorization vulnerability in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over a network . The CVSS v3.1 base score is 9.1 (Critical) with a scope change, indicating high impact on confidentiality, integrity, and availability onc...
EUVD-2026-73146
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-73130
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network...
CVE-2026-69382
CVE-2026-69382 affects Microsoft Exchange Server due to the use of a broken or risky cryptographic algorithm , allowing an unauthorized, unauthenticated attacker to disclose information over a network . The CVSS 3.1 base score is 5.9 (MEDIUM) , reflecting a network attack vector with high complex...
CVE-2026-69380
CVE-2026-69380 is a missing authorization vulnerability in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 8.1 (HIGH) , with high impact to confidentiality and integrity and no availability impact. Attack complexity is low, ...