3781 matches found
CVE-2005-0563
Microsoft Outlook Web Access (OWA) for Exchange Server 5.5 contains a cross-site scripting (XSS) vulnerability in the HTML encoding used in Compose New Message, allowing an attacker to cause script execution in the user’s context via a specially crafted email (encoded javascript: URL in an IMG ta...
CVE-2004-2137
Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC fields, which may allow remote attackers to obtain sensitive information...
CVE-2005-0563
Cross-site scripting XSS vulnerability in Microsoft Outlook Web Access OWA component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL "jav&X41script:" in an IMG tag...
CVE-2005-1213
Microsoft Outlook Express NNTP LIST buffer overflow (CVE-2005-1213) affects MSOE.DLL in Outlook Express 5.5 SP2, 6 and 6 SP1. A crafted LIST response with a long second field allows a remote attacker to execute arbitrary code via the NNTP channel. The vulnerability arises from a stack-based buffe...
CVE-2004-2137
The CVE-2004-2137 issue affects Outlook Express 6.0 when users send multipart e-mail messages with the setting to “Break apart messages larger than.” The vulnerability is that BCC recipients are leaked to To/CC addresses during this process, potentially exposing sensitive contact information. The...
CVE-2005-0563
Cross-site scripting XSS vulnerability in Microsoft Outlook Web Access OWA component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL "jav&X41script:" in an IMG tag...
CVE-2005-1213
Stack-based buffer overflow in the news reader for Microsoft Outlook Express MSOE.DLL 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field...
CVE-2005-1213
Stack-based buffer overflow in the news reader for Microsoft Outlook Express MSOE.DLL 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a long second field...
Microsoft Outlook Web Access vulnerable to cross-site scripting
Overview Microsoft Outlook Web Access may be vulnerable to cross-site scripting attacks. Description Microsoft Outlook Web Access OWA allows users to access their email accounts on a Microsoft Exchange server from another host through a web browser.Microsoft Outlook Web Access for Exchange Server...
Microsoft Outlook Express vulnerable to remote code execution
Overview A vulnerability in Microsoft Outlook Express's NNTP response parsing may allow an attacker to execute arbitrary code. Description Microsoft Outlook Express contains support for Network News Transfer Protocol NNTP data, which is defined in RFC 977 and RFC 2980. A flaw in Outlook Express'...
MS05-030: Vulnerability in Outlook Express Could Allow Remote Code Execution (897715)
The remote host is running a version of Microsoft Outlook Express that could allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to lure a user to connect to a rogue NNTP news server sending malformed replies to several queries. C Tenable...
MS05-029: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (895179)
The remote host is running a version of the Outlook Web Access that is affected by a cross-site scripting flaw. This vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts ...
Microsoft Outlook Express NNTP Response Parsing Buffer Overflow Vulnerability
Description Microsoft Outlook Express is prone to a buffer overflow when parsing NNTP responses. Successful exploits could allow arbitrary code to run in the context of the user running the application. Technologies Affected Microsoft Outlook Express 5.0 Microsoft Outlook Express 5.5 Microsoft...
Microsoft Exchange Server Outlook Web Access HTML Injection Vulnerability
Description Outlook Web Access is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the affected application of an unsuspecting user in...
Microsoft Outlook Express 4.x5.x6.0 - Attachment Processing File Extension Obfuscation
Microsoft Outlook Express 4.x5.x6.0 - Attachment Processing File Extension Obfuscation source: https://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue...
Microsoft Outlook Express 4.x/5.x/6.0 - Attachment Processing File Extension Obfuscation
source: https://www.securityfocus.com/bid/13837/info Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email...
Kerio MailServer < 6.0.10 Multiple Mail Handling DoS
According to its banner, the remote host is running a version of Kerio MailServer prior to 6.0.10. In those versions, crashes can occur when downloading certain email messages in IMAP or Outlook with Kerio Outlook Connector KOC or, under Linux, when parsing email messages with multiple embedded...
Kerio MailServer DoS
WebMail vulnerability leads to 100 CPU exhaustion. Crash on multiple attached .eml files, DoS with IMAP and Outlook Connectors...
CVE-2005-1052
Microsoft Outlook 2003 and Outlook Web Access OWA 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could allow remote attackers to spoof e-mail addresses...