CVE-2016-0031

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029...

CVE-2016-0032

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."...

Microsoft Exchange Server Address Spoofing Vulnerabilities (3124557)

This host is missing an important security update according to Microsoft Bulletin MS16-010. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

MS16-010: Security Update in Microsoft Exchange Server to Address Spoofing (3124557)

The remote Microsoft Exchange server is missing a security update. It is, therefore, affected by multiple spoofing vulnerabilities in Outlook Web Access OWA due to a failure to properly handle web requests. An attacker can exploit these vulnerabilities, via a crafted email containing a malicious...

KLA10736 Spoofing vulnerability in Microsoft Exchange Server

Improper web requests handling was found in Microsoft Exchange Server at Outlook Web Access. By exploiting this vulnerability malicious users can spoof user interface. This vulnerability can be exploited remotely via a specially designed email with malicious link. Original advisories CVE-2016-003...

Trust Management Vulnerability in Multiple Arris Devices

The Arris DG860A, TG862A and TG862G are modem products from the Arris Group of Companies. A security vulnerability exists in a number of Arris devices that stems from a program using hard-coded passwords based on serial numbers. The vulnerability can be exploited by a remote attacker to gain acce...

Mail.ru: [w1.dwar.ru] Core Dump

Если помните багу с HeartBleed, то там можно было читать оперативную память сервера в поисках Credential информации. Здесь же похожая уязвимость, когда сервер crash-ится, на жестком диске остаётся дамп памяти вместе со всеми данными, которые можно анализировать для выяснения причины падения...

Moxa OnCell Central Manager Server MessageBrokerServlet Authentication Bypass Vulnerability

Moxa OnCell Central Manager provides Web access to private IP network devices. A security vulnerability exists in the implementation of Moxa OnCell Central Manager's MessageBrokerServlet that fails to authenticate the user's identity before accepting commands, which can be exploited by an attacke...

Outlook Web Access Targeted Attack

Attackers aiming for lateral movement inside an enterprise network have done well in the past to target domain controller credentials. Researchers at Cybereason, however, have uncovered a targeted attack in which hackers were able to burrow onto the corporate network and steal thousands of...

The vulnerability of the Microsoft Exchange Server system’s automation mechanism allows a perpetrator to gain access to protected information.

The vulnerability of the Outlook Web Access component of the Microsoft Exchange Server automation system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information through a...

The vulnerability of the Microsoft Exchange Server system’s automation mechanism allows a hacker to inject arbitrary web or HTML code.

The vulnerability of the Outlook Web Access component of the Microsoft Exchange Server automation system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code through a special...

Microsoft Exchange Server 中的漏洞可能允许信息泄漏 (MS15-103)

漏洞描述：Microsoft Exchange Server 是个消息与协作系统。Exchange server可以被用来构架应用于企业、学校的邮件系统或免费邮件系统。它还是一个协作平台。你可以在此基础上开发工作流，知识管理系统，Web系统或者是其他消息系统。 Microsoft Exchange Server 中存在多个漏洞。 Outlook Web Access OWA 未正确处理 Web 请求和清理用户输入和电子邮件内容，最严重的漏洞可能允许信息泄漏。漏洞影响：microsoft:exchangeserver:2013:cumulativeupdate8...

Microsoft Exchange Server Cross-Site Scripting Vulnerability (CNVD-2015-05967)

Microsoft Exchange Server is a suite of e-mail service components from Microsoft. A cross-site scripting vulnerability exists in Microsoft Exchange Server 2013 Cumulative Update 8/9/SP1, Outlook Web Access OWA, which can be exploited by remote attackers to inject arbitrary web script or HTML via ...

MS15-103: Vulnerabilities in Microsoft Exchange Server Could Allow Information Disclosure (3089250)

The remote Microsoft Exchange server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists Outlook Web Access OWA due to improper handling of web requests. An unauthenticated, remote attacker can exploit this, via a...

Microsoft Exchange Server Cross-Site Scripting Vulnerability (CNVD-2015-05966)

Microsoft Exchange Server is a suite of e-mail service components from Microsoft. A cross-site scripting vulnerability exists in Microsoft Exchange Server 2013 Cumulative Update 8/9/SP1, Outlook Web Access OWA, which can be exploited by remote attackers to inject arbitrary web script or HTML via ...

CVE-2015-2544

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."...

CVE-2015-2543

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."...

CVE-2015-2505

Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."...

Information disclosure

Outlook Web Access OWA in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."...