Cross site scripting

Cross-site scripting XSS vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."...

Server side request forgery (ssrf)

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery SSRF issue, aka "Exchange Server-Side Request Forger...

CVE-2015-1764

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery SSRF issue, aka "Exchange Server-Side Request Forger...

CVE-2015-2359

CVE-2015-2359 affects Microsoft Exchange Server 2013, specifically the web applications in Cumulative Update 8. The vulnerability is a Cross-site Scripting/HTML injection issue caused by insufficient sanitization of user-supplied input in Exchange web applications. Potential impact includes execu...

CVE-2015-1764

CVE-2015-1764 describes a Server-Side Request Forgery in Microsoft Exchange Server 2013 SP1 with CU8, where Exchange web applications fail to enforce Same Origin Policy, allowing remote attackers to send HTTP requests to intranet hosts. Affected: Microsoft Exchange Server 2013 SP1 and CU8. Impact...

Microsoft Exchange Server Input Validation Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. An input validation vulnerability exists in Microsoft Exchange Server, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain sensitive information or hija...

Microsoft Exchange Server Improperly Manages User Sessions Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A security vulnerability exists in Microsoft Exchange Server that allows a remote attacker to exploit the vulnerability to submit a special request to access the application in another user's context...

Microsoft Exchange Server Same-Origin Policy Bypass Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A same-origin policy bypass vulnerability exists in Microsoft Exchange Server, which could be exploited by a remote attacker to submit a special web application request to bypass the same-origin policy and obtain sensitive...

Microsoft Exchange Server Privilege Escalation Vulnerability (3062157)

This host is missing an important security update according to Microsoft Bulletin MS15-064. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Description Microsoft Exchange Server is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the same-origin policy, obtain sensitive information and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks...

Microsoft Exchange Server CVE-2015-2359 HTML Injection Vulnerability

Description Microsoft Exchange Server is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

KLA10598 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper same-origin policy handling can be exploited remotely via a...

Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

Description Microsoft Exchange Server is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft Exchange...

MS15-064: Vulnerabilities in Exchange Server could allow elevation of privilege: June 9, 2015

None None...

Microsoft Exchange Server ExchangeDLP Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A cross-site scripting vulnerability exists in Microsoft Exchange Server ExchangeDLP's handling of user-submitted parameters, which can be exploited by a remote attacker to construct a malicious URI and trick the user into...

Microsoft Exchange Server Canary Parameter Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A cross-site scripting vulnerability exists in Microsoft Exchange Server's handling of user-submitted parameters, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which...

Microsoft Exchange Server Fake Meeting Request Spoofing Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. Microsoft Exchange Server fails to properly verify the identity of the meeting organizer when processing meeting requests, and a remote attacker can exploit the vulnerability to construct a malicious URI that induces a user to...

Microsoft Exchange Server Error Message Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A cross-site scripting vulnerability exists in Microsoft Exchange Server's handling of error messages, which can be exploited by remote attackers to construct malicious URIs that can be tricked into being parsed by the user,...

Microsoft Exchange Server Audit Reports Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. Microsoft Exchange Server audit reports a cross-site scripting vulnerability in the processing of user-submitted parameters, which can be exploited by remote attackers to construct malicious URIs that can be tricked into being...

CVE-2015-1630

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."...