Microsoft Exchange OWA Cross-Site Scripting and Spoofing (MS04-026; CVE-2004-0203)

Microsoft Exchange Outlook Web Access is a web application that is an alternative to Microsoft Outlook. It allows users to access their emails and public folders using a web browser. Outlook Web Access is implemented in ASP and is hosted on a system with Internet Information Server IIS installed...

Yahoo webmail xss&OWA xss

Yahoo webmail和Outlook web access是使用比较多的webmail，可以通过web界面来收发电子邮件。但是80sec发现在他们处理某些字符集的时候存在漏洞，可能导致Xss脚本攻击。我们发现后及时通知了官方，官方也已经予以修补。 Yahoo webmail Outlook web access 官方也已经予以修补。 style x background: url'http://www.google.cnchr';background: url'http://;color:red;www.google.cn'; /style div id="x"codz/div...

CVE-2008-1547

Summary: CVE-2008-1547 is an open redirect vulnerability in exchweb/bin/redir.asp of Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (build 6.5.7638). An attacker can lure a logged-in user to click a URL parameter that redirects to an arbitrary site, enabling phishing via the redi...

Microsoft Outlook Web Access for Exchange Server 2003 - redir.asp Open Redirection

Microsoft Outlook Web Access for Exchange Server 2003 - redir.asp Open Redirection source: https://www.securityfocus.com/bid/31765/info Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploi...

Microsoft Exchange OWA 长用户名拒绝服务漏洞

微软Exchange OWAOutlook Web Access组件存在一个拒绝服务漏洞。当使用很多"%"作 为用户名和口令登录时，OWA会返回HTTP 500 - Internal server error信息。用户将不 能通过IE进行登录。据报告说WWW发布服务和IIS管理服务会停止响应。 Microsoft Exchange Server 5.5 SP4 Microsoft Exchange Server 5.5 SP3 Microsoft Exchange Server 5.5 SP2 Microsoft Exchange Server 5.5 SP1 Microsoft...

Outlook Web Access for Exchange Server邮件字段跨站脚本漏洞（MS08-039）

BUGTRAQ ID: 30130 CVECAN ID: CVE-2008-2247,CVE-2008-2248 Microsoft Exchange Server是一款流行的邮件服务器，Outlook Web Access是Exchange中用于通过Web浏览器读取和发送邮件的工具。 Outlook Web Access for Exchange Server中存在跨站脚本漏洞，允许在Exchange...

CVE-2008-2248

CVE-2008-2248 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw stems from insufficient validation of HTML when rendering emails, enabling an attacker to inject script or HTML via unspecified HTML in messages and potentially perfo...

CVE-2008-2247

CVE-2008-2247 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw arises from insufficient validation of e-mail fields when opening mail within an OWA client, allowing an attacker to inject arbitrary script and potentially elevate p...

CVE-2008-2143

CVE-2008-2143 affects unspecified Microsoft Outlook Web Access (OWA) versions. The underlying issue is that OWA uses Cache-Control: no-cache instead of no-store, which may allow browsers following RFC-2616 to cache sensitive information. Impact is potential exposure of cached data; no exploitatio...

CVE-2008-2143

Unspecified versions of Microsoft Outlook Web Access OWA use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information...

Microsoft Exchange multiple security vulnerabilities

OWA crossite scripting, IMAP DoS, iCal parsing DoS, Base64 decoding memory corruption, IMAP DoS...

CVE-2007-0220

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

CVE-2007-0220

CVE-2007-0220 is a cross-site scripting vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2000 SP3 and Exchange Server 2003 SP1/SP2. The issue arises from an incorrectly handled UTF character set label, allowing remote attackers to run scripts, spoof content, or access inform...

Microsoft Exchange Outlook Web Access UTF character set label script injection vulnerability

Overview Microsoft Exchange Outlook Web Access OWA fails to properly handle the UTF character set label, which can allow a remote, unauthenticated attacker to execute script within the security context of the OWA user. Description OWA allows users to access their email accounts on a Microsoft...

CVE-2006-6940

CVE-2006-6940 describes a buffer overflow in the ParseHeader function of clsOWA.cls within POP3/SMTP to OWA (pop2owa) 1.1.3. A long header in an e‑mail message can allow a remote attacker to execute arbitrary code. The vulnerability affects pop2owa 1.1.3 and is evidenced by the NVD entry with a b...

CVE-2006-1193

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

CVE-2006-1193 describes a script-injection (XSS) vulnerability in Microsoft Exchange Server running Outlook Web Access (OWA) across Exchange 2000 SP1–SP3. The issue arises from improper sanitization of e-mail content read via OWA, allowing a remote attacker to inject and execute HTML/script in th...

Outlook Web anonymous access

It is possible to browse the information of the OWA server by accessing as an anonymous user. SPDX-FileCopyrightText: 2001 Javier Fernandez-Sanguino Pena Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...