Microsoft Exchange Server Outlook Web Access Script Injection (MS06-029; CVE-2006-1193)

Microsoft provides server and client side implementations of email protocols such as SMTP, POP3 and IMAP. The widely used Exchange Server product is an implementation of an email server capable of handling most standard Internet protocols as well as numerous proprietary Microsoft protocols and...

IBM Lotus Notes Cross Site Scripting (CVE-2005-2175)

IBM Lotus Domino/Notes is a software suite that provides enterprise-class messaging, calendaring, and scheduling capabilities for collaborative applications. There exists a security flaw in IBM Lotus Domino Web Access DWA and Lotus Notes. Embedded JavaScript in HTML formatted Emails will...

On the Outlook Web Access Attacks, Adobe and Microsoft Patch Releases

In this episode, Ryan and Dennis discuss the Outlook Web Access phishing attacks, the huge Microsoft and Adobe patch releases and the massive scope of the botnet problem. Download SHOW NOTES: Zeus Trojan Part of New Outlook Web Access Phishing Scam Microsoft Ships Largest Batch of Security Patche...

Outlook Web Access Attack Using Pushdo Botnet

Here are some technical details on the Outlook Web Access phishing scheme. 1. The Spam According to our preliminary research, the spam emails which attacked OWA users, including Kaspersky, were sent using the pushdo botnet – which is based on malware from the Backdoor.Win32.NewRes family. These...

Zeus Trojan Part of New Outlook Web Access Phishing Scam

The attackers behind the Zeus Trojan have unleashed a new phishing scam that is specifically targeted at users of the popular corporate webmail tool Outlook Web Access. The phishing emails include the recipient’s actual email address and appear to be an update to the OWA application. The mail...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Lotus iNotes aka Domino Web Access or DWA before 211.241 for Domino 8.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR EZEL7UURYC...

CVE-2009-3105

CVE-2009-3105 is an XSS vulnerability in IBM Lotus iNotes (Domino Web Access) prior to 211.241 for Domino 8.0.1. It allows remote attackers to inject arbitrary web script or HTML via unspecified vectors (SPR EZEL7UURYC). The NVD entry lists a Medium severity (CVSS v2: AV:N/AC:M/Au:N/C:N/I:P/A:N) ...

IBM Lotus Domino Web Access跨站脚本漏洞

Bugraq ID: 36286 IBM Lotus Domino Web Access是一款IBM用来访问基于Domino的邮件文件的主要Web客户机。 在返回用户之前没有对输入进行充分过滤，攻击者可以利用漏洞进行跨站脚本攻击，导致恶意脚本代码在用户浏览器上执行。 IBM Lotus Domino Web Access 8.x 厂商解决方案 用户可参考如下安全公告获得补丁信息： http://www-01.ibm.com/support/docview.wss?uid=swg27016745...

Novell Access Manager管理控制台信息泄漏漏洞

Bugraq ID: 35734 Novell Access Manger是一款完整的基于角色的Web 访问管理解决方案。 Novell Access Manger管理控制台存在未明错误，远程攻击者可以利用漏洞访问系统文件获得敏感信息。 目前没有详细漏洞细节提供。 Novell Access Manager 3.1 Novell Access Manager 3 用户可参考如下安全公告获得补丁信息：...

JVN#82744714 Cross-site scripting vulnerability in apricot.php from LovPop.net

apricot.php from LovPop.net is a software to analyze web access logs. apricot.php contains a cross-site scripting vulnerability. Note that future releases and maintenance of apricot.php ended on March 19, 2009. Users who wish to analyze access logs are recommended to use a different product that...

JVN#23558374 Cross-site scripting vulnerability in Access Analyzer CGI Standard Version (Ver. 3.x)

Access Analyzer CGI Standard Version provided by futomi's CGI Cafe is a software to analyze web access logs. Access Analyzer CGI Standard Version Ver. 3.x contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the...

[SECURITY] Fedora 10 Update: squidGuard-1.2.1-2.fc10

squidGuard can be used to - limit the web access for some users to a list of accepted/well known web servers and/or URLs only. - block access to some listed or blacklisted web servers and/or URLs for some users. - block access to URLs matching a list of regular expressions or words for some users...

[SECURITY] Fedora 9 Update: squidGuard-1.2.1-2.fc9

squidGuard can be used to - limit the web access for some users to a list of accepted/well known web servers and/or URLs only. - block access to some listed or blacklisted web servers and/or URLs for some users. - block access to URLs matching a list of regular expressions or words for some users...

CVE-2009-0419

Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via...

PR08-23: XSS on Novell GroupWise WebAccess

PR08-23: XSS on Novell GroupWise WebAccess Vulnerability found: 2nd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: Medium Credits: Richard Brain of ProCheckUp Ltd www.procheckup.com. ProCheckUp thanks Novell for working with us in such a...

Microsoft Outlook Web Access redir.asp URI重新定向漏洞

BUGTRAQ ID: 31765 CVECAN ID: CVE-2008-1547 Microsoft Exchange Server是一款流行的邮件服务器，Outlook Web Access是Exchange中用于通过Web浏览器读取和发送邮件的工具。 Outlook Web Access的exchweb/bin/redir.asp页面存在重新定向漏洞，远程攻击者可以在邮件中发送特制的URL，如果用户已经登录的话，则点击该链接就会被立即重新定向到钓鱼网站；如果用户未登录，则点击后会显示登录页面，然后在成功认证后将用户重新定向到钓鱼网站。 Microsoft Outlook Web...

CVE-2008-1547

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter...

Open redirect

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter...

CVE-2008-1547

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter...

Microsoft Outlook Web Access for Exchange Server 2003 - 'redir.asp' Open Redirection

source: https://www.securityfocus.com/bid/31765/info Outlook Web Access is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks. OWA 6.5 SP 2 is vulnerable; other versions may also ...