ViaBTC Exchange Server Digital Error Vulnerability

ViaBTC Exchange Server is a backend engine dedicated to cryptocurrency trading. An integer overflow vulnerability exists in the utils/utrpc.c file in versions of ViaBTC Exchange Server prior to 2018-08-21. An attacker could exploit this vulnerability to cause memory corruption...

ViaBTC Exchange Server Digital Error Vulnerability

ViaBTC Exchange Server is a backend engine dedicated to cryptocurrency trading. An integer overflow vulnerability exists in the network/nwbuf.c file in versions of ViaBTC Exchange Server prior to 2018-08-21. An attacker could exploit this vulnerability to cause memory corruption...

ViaBTC Exchange Server Digital Error Vulnerability

ViaBTC Exchange Server is a backend engine dedicated to cryptocurrency trading. An integer overflow vulnerability exists in the utils/utwssvr.c file in versions of ViaBTC Exchange Server prior to 2018-08-21. An attacker could exploit this vulnerability to cause memory corruption...

SRC-2020-0026 : Microsoft Exchange Server NewExchangeCertificate WriteRequest File Write Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exchange Server. Authentication with the “Exchange Server Certificates” role is required to exploit this vulnerability. The specific flaw exists within the processing of the...

SRC-2020-0025 : Microsoft Exchange Server ExportExchangeCertificate WriteCertiricate File Write Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exchange Server. Authentication with the “Exchange Server Certificates” role is required to exploit this vulnerability. The specific flaw exists within the WriteCertiricate...

SRC-2020-0019 : Microsoft Exchange Server DlpUtils AddTenantDlpPolicy Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exchange Server. Authentication with the “Data Loss Prevention” role is required to exploit this vulnerability. The specific flaw exists within the processing of the...

SRC-2021-0004 : Microsoft Exchange Server msExchEcpCanary Cross Site Request Forgery Elevation of Privilege Vulnerability

Vulnerability Details: This vulnerability allows remote attackers escalate privileges on affected installations of Microsoft Exchange Server. Authentication and user interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists with...

SRC-2020-0027 : Microsoft Exchange Server NewExchangeCertificate WriteRequest File Overwrite Denial of Service Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to cause a denial of service against affected installations of Exchange Server. Authentication with the “Exchange Server Certificates” role is required to exploit this vulnerability. The specific flaw exists within the processing o...

Exploit for CVE-2019-1040

CVE-2019-1040 Great writeup! Exploiting CVE-2019-1040 - Combining relay vulnerabilities for RCE and Domain Admin . So, I wrote CVE-2019-1040.py for easy to use. You can also check out my exchange2domain repo: https://github.com/ridter/exchange2domain, another way to use exchange to get DC...

SRC-2020-0031 : Microsoft Exchange Server EWS RouteComplaint ParseComplaintData XML External Entity Processing Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose information on affected installations of Exchange Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of RouteComplaint SOAP requests to the EWS service...

SRC-2020-0030 : Microsoft Exchange Server OWA OneDriveProUtilities GetWacUrl XML External Entity Processing Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose information on affected installations of Exchange Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of GetWacIframeUrlForOneDrive service commands. The issu...

Exploit for CVE-2018-8581

CVE-2018-8581 这是一个邮箱层面的横向渗透和提权漏洞 它可以在拥有了一个普通权限邮箱账号密码后，完成对其他用户包括域管理员邮箱收件箱的委托接管 本EXP脚本是在原PoC基础上修改的增强版一键脚本，它将在配置好相关参数后，自动完成目标邮箱inbox收件箱的添加委托和删除委托操作，以方便甲方安全部门和红队对授权企业完成一次模拟攻击过程 原PoC是两个脚本配合使用完成添加收信规则的操作，在甲方红队实际工作中不怎么实用，而原PoC除了需要邮箱外，还需要设置目标邮箱用户的SID，但在参考文章中提到的获取用户SID的方法，我在实际环境中测试Exchange Server...

The vulnerability of Microsoft Exchange Server servers stems from the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of Microsoft Exchange Server lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created request...

CVE-2020-0903

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

CVE-2020-0903

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

CVE-2020-0903

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

CVE-2020-0903

Mode C: The CVE-2020-0903 entry corresponds to a Microsoft Exchange Server cross-site scripting vulnerability exposed when the server fails to sanitize certain crafted web requests. Connected documentation (Security Update KB4540123) confirms affected products: Exchange Server 2016 and 2019 (CU4/...

CVE-2020-0903

A cross-site-scripting XSS vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'...

Microsoft Issues March 2020 Updates to Patch 115 Security Flaws

Microsoft today released security updates to fix a total of 115 new security vulnerabilities in various versions of its Windows operating system and related software—making March 2020 edition the biggest ever Patch Tuesday in the company's history. Of the 115 bugs spanning its various products —...