CVE-2018-8159

CVE-2018-8159 is an elevation-of-privilege issue in Microsoft Exchange Server related to Outlook Web Access (OWA) not handling web requests properly. The connected Nessus plugin text indicates exploitation could allow script/content injection and user-information disclosure; it does not provide c...

Microsoft Exchange Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...

Design/Logic Flaw

Open Web Analytics OWA before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owaevent parameter to queue.php...

CVE-2014-2294

Open Web Analytics (OWA) before 1.5.7 is vulnerable to PHP object injection via the owa_event parameter to queue.php. The root cause is unsafe unserialize() of a crafted serialized object (after decoding base64) in queue.php, enabling remote attackers to manipulate configuration or achieve arbitr...

Cross site request forgery (csrf)

Open Web Analytics OWA before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name...

CVE-2014-1457

Open Web Analytics (OWA) before 1.5.6 is affected by CVE-2014-1457: it generates nonces for CSRF protection in a way that can be bypassed by knowledge of an OWA user name. Affects the OWA component responsible for CSRF defense; root cause is nonce generation not sufficiently random. Impact is par...

CVE-2018-0940

Microsoft Exchange Outlook Web Access OWA in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016...

CVE-2018-0940

CVE-2018-0940 affects certain Microsoft Exchange Server versions (2010 SP3 Update Rollup 20; 2013 CU18/19; 2013 SP1; 2016 CU7/8). The vulnerability is an elevation of privilege caused by how links in the body of email messages are rewritten, enabling a user to potentially gain higher privileges v...

CVE-2018-0940

Microsoft Exchange Outlook Web Access OWA in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016...

Update Rollup 20 for Exchange Server 2010 Service Pack 3

Update Rollup 20 for Exchange Server 2010 Service Pack 3 Summary This update rollup is included in a security update. This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access OWA. The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange...

Microsoft Exchange Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly sanitize links presented to users. An attacker who successfully exploited this vulnerability could override the OWA interface with a fake login page and attempt to trick the user into...

Security Updates for Exchange (March 2018)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the way that Microsoft Exchange Server handles URL redirects. If an impacted user is using Microsoft...

Spoofing

Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access OWA validates web requests, aka "Microsoft Exchange Spoofing Vulnerability"...

CVE-2017-11932

CVE-2017-11932 describes a spoofing vulnerability in Microsoft Exchange Server related to Outlook Web Access (OWA) validating web requests. Connected sources indicate it affects Exchange Server 2016 CU6/7 and 2013 CU6/7, with exploitation possible via specially crafted emails containing malicious...

Description of the security update for Microsoft Exchange: December 12, 2017

None None...

Microsoft Exchange Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...

Security Updates for Exchange (December 2017)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests. An attacker who...

CVE-2017-8758

Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."...

Cross site scripting

Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."...

CVE-2017-8758

Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."...