Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or...

Outlook Web Access Targeted Attack

Attackers aiming for lateral movement inside an enterprise network have done well in the past to target domain controller credentials. Researchers at Cybereason, however, have uncovered a targeted attack in which hackers were able to burrow onto the corporate network and steal thousands of...

New Attack Targeting Microsoft Outlook Web App (OWA) to Steal Email Passwords

Researchers have unearthed a dangerous backdoor in Microsoft's Outlook Web Application OWA that has allowed hackers to steal e-mail authentication credentials from major organizations. The Microsoft Outlook Web Application or OWA is an Internet-facing webmail server that is being deployed in...

CVE-2015-2543

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."...

CVE-2015-2505

Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."...

CVE-2015-2544

CVE-2015-2544 is a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2013, affecting Cumulative Update 8/9 and SP1. The issue arises from improper handling/sanitization of crafted email content, allowing remote attackers to inject arbitrary web scri...

CVE-2015-2543

CVE-2015-2543 is an XSS vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2013 Cumulative Update 8 and 9. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted e‑mail message. Affected product details are Exchange Server 2013 CU8/CU9 (OWA); ro...

CVE-2015-2505

The CVE-2015-2505 issue affects Microsoft Exchange Server (Outlook Web Access) 2013 CU8/CU9 and SP1. Root cause: OWA does not properly handle certain web requests, allowing a remote attacker to view potentially sensitive stack trace information. Impact: information disclosure via remote access. E...

MS15-103: Description of the security update for Exchange Server: September 8, 2015

None None...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross...

CVE-2015-1629

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."...

CVE-2015-1630

CVE-2015-1630 is an XSS vulnerability in Outlook Web App (OWA) for Microsoft Exchange Server 2013 SP1 and Cumulative Update 7. The issue arises in processing of user-supplied URLs in OWA (Audit Report Cross Site Scripting). Attacks can inject arbitrary script/HTML via a crafted URL, impacting web...

CVE-2015-1628

CVE-2015-1628 is an XSS vulnerability in Outlook Web App (OWA) of Microsoft Exchange Server 2013 SP1 with CU7. A crafted X-OWA-Canary cookie enables a remote attacker to inject arbitrary web script/HTML via an AD.RecipientType.User action. Affected product: Microsoft Exchange Server 2013 SP1/CU7;...

CVE-2015-1632

The CVE-2015-1632 issue is a Cross-site scripting vulnerability in Outlook Web App (OWA) errorfe.aspx of Microsoft Exchange Server 2013 SP1 and Cumulative Update 7, exploitable via the msgParam parameter in an authError action. The root cause is improper sanitization of error messages in OWA, ena...

CVE-2015-1632

Cross-site scripting XSS vulnerability in errorfe.aspx in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site...

CVE-2015-1629

CVE-2015-1629 is a Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) of Microsoft Exchange Server 2013 SP1 with CU7. The root cause is improper sanitization of page content in OWA, allowing remote attackers to inject arbitrary script/HTML via a crafted URL. Affected product: Micro...

SafeNet SAS OWA Agent Detection (HTTP)

HTTP based detection of the SafeNet Authentication Service SAS Outlook Web Access OWA Agent formerly CRYPTOCard. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6326...

CVE-2014-6336

CVE-2014-6336 affects Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 (Exchange 2013 SP1+CU6) via an improper validation of redirection tokens in Outlook Web App (OWA), enabling remote redirection to arbitrary sites and spoofing email origin. Connected sources confirm the affected prod...