CVE-2014-6319

CVE-2014-6319 affects Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 plus CU6. The root cause is improper validation of tokens in requests, enabling remote attackers to spoof the origin of e‑mail messages. Documented affected versions align with MS14-075 guida...

Microsoft Exchange Server Outlook Web Access URL Redirection (MS14-075; CVE-2014-6336)

A spoofing vulnerability exists in Microsoft Exchange Server. The vulnerability is due to an error in Microsoft Exchange when Microsoft Outlook Web Access OWA fails to properly validate redirection tokens. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

Outlook Web App (OWA) Brute Force Utility

This module tests credentials on OWA 2003, 2007, 2010, 2013, and 2016 servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Outlook Web App OWA Brute Force Utility', 'Description' = %q This...

Microsoft Exchange IIS HTTP Internal IP Address Disclosure

No description provided by source. Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchan...

DUO-PSA-2014-006: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-006 Publication Date: 2014-10-09 Revision Date: 2014-10-16 Status: Confirmed, Fixed Document Revision: 2 Overview Duo Security has identified an issue in which it may be possible for users to perform certain actions without completing...

DUO-PSA-2014-006: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-006 Publication Date: 2014-10-09 Revision Date: 2014-10-16 Status: Confirmed, Fixed Document Revision: 2 Overview Duo Security has identified an issue in which it may be possible for users to perform certain actions without completing...

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure Metasploit Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange...

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)

Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchange OWA 2003, Exchange CAS...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013 Tested on: Exchange OWA 2003, Exchange CAS...

Microsoft Outlook 5.5/2000 Web Access HTML Attachment Script Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8113/info OWA contains a vulnerability that may result in attacker-supplied script code executing within the context of the mail interface when processing e-mail containing HTML message attachments. It is possible to...

Microsoft Outlook Web Access (OWA) 8.2.254.0 - Information Disclosure vulnerability

No description provided by source. $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Microsoft Outlook Web Access OWA version 8.2.254.0 OS: Windows Server 2003 Internet Explorer 7 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ There is an information disclosure vulnerability in Microsoft...

Outlook Web Access 2007 CSRF Vulnerability

No description provided by source. Source: http://sites.google.com/site/tentacoloviola/pwning-corporate-webmails Demo: http://www.youtube.com/watch?v=Bx-zfu0uXYg After Nduja Connection worm and the Memova issue, it's now time to shed a light on vulnerabilities affecting corporate webmails. And wh...

[SWRX-2014-001] Open Web Analytics Pre-Auth SQL Injection

Dell SecureWorks Security Advisory SWRX-2014-001 Open Web Analytics Pre-Auth SQL Injection Advisory Information Title: Open Web Analytics Pre-Auth SQL Injection Advisory ID: SWRX-2014-001 Advisory URL: http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2014-001/ Date published:...

CVE-2014-1456

Open Web Analytics (OWA) prior to version 1.5.6 is affected by CVE-2014-1456, a cross-site scripting (XSS) vulnerability in the login page. The issue allows injection of arbitrary script or HTML via the owa_user_id parameter to index.php, with impact described as partial integrity impact and no c...

Open Web Analytics (OWA) Detection (HTTP)

HTTP based detection of Open Web Analytics OWA. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-1206

Open Web Analytics (OWA)

DUO-PSA-2014-001: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-001 Publication Date: 2014-01-08 Status: Confirmed, Fixed Document Revision: 2 Overview Older versions of the Duo Security Outlook Web Access OWA integration may be vulnerable to a bypass of the second authentication factor. Description Unde...

DUO-PSA-2014-001: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-001 Publication Date: 2014-01-08 Status: Confirmed, Fixed Document Revision: 2 Overview Older versions of the Duo Security Outlook Web Access OWA integration may be vulnerable to a bypass of the second authentication factor. Description Unde...

CVE-2013-5072

Cross-site scripting XSS vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."...

CVE-2013-5072

The CVE-2013-5072 entry refers to a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2010 SP2/SP3 and 2013 Cumulative Updates 2 and 3. The vulnerability arises from improper sanitization of input in OWA, permitting a crafted URL to inject arbitrary...