HTTP Response Splitting vulnerability in Microsoft Outlook Web Access for Exchange 5.5

//////////////////////////////////////////////////////////////////// //===================== Security Advisory ====================// //////////////////////////////////////////////////////////////////// -------------------------------------------------------------------- ----- Microsoft Outlook W...

Microsoft Outlook Web Access (OWA) Version Detection

Microsoft Exchange Server with Outlook Web Access OWA embeds the Exchange version number inside the default HTML web page. By requesting the default HTML page, Nessus was able to extract the Microsoft Exchange server version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Microsoft Outlook Web Access contains vulnerability in HTML redirection query

Overview A cross-site scripting vulnerability in Microsoft Exchange 5.5 Outlook Web Access OWA could allow an attacker to execute arbitrary scripting code in the victim's browser. Description Outlook Web Access OWA is a component of Microsoft Exchange. By using OWA, a server that is running...

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Description Microsoft Exchange Outlook Web Access OWA is prone to HTTP response splitting attacks. This issue could permit hostile script to be injected into client sessions, which could gain access to properties of the OWA server and Web pages hosted on the site. It is noted that the attacker mu...

MS04-026: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (842436)

The remote host runs Outlook Web Access. Outlook Web Access is a service for Microsoft Exchange, that provides web-based email, calendaring and contact management to end users. The remote version of Outlook Web Access is vulnerable to a cross-site scripting attack that could allow an attacker to...

CVE-2004-0668

Summary: CVE-2004-0668 affects IBM Lotus Domino Web Access, where opening a large email message via Web Access can trigger an out-of-memory condition in the Domino server, leading to a denial of service. The connected advisory CPAI-2004-155 describes the vulnerability as occurring when processing...

Domino Web Access DoS

Message with large broken image causes server to crash on message reading...

IBM Lotus Domino Server 6 - Web Access Remote Denial of Service

IBM Lotus Domino Server 6 - Web Access Remote Denial of Service source: https://www.securityfocus.com/bid/10641/info Lotus Domino Server is reported prone to a remote denial of service vulnerability. The issue is reported to exist when a malicious email that is received on the affected server, is...

IBM Lotus Domino Server 6 - Web Access Remote Denial of Service

source: https://www.securityfocus.com/bid/10641/info Lotus Domino Server is reported prone to a remote denial of service vulnerability. The issue is reported to exist when a malicious email that is received on the affected server, is opened through the Domino Web Access interface by a client. A...

Microsoft Exchange Server 2003 fails to assign user credentials to proper mailbox

Overview A flaw in the authentication mechanism that Microsoft Exchange Server 2003 uses for Outlook Web Access users in some configurations could expose another user's mailbox. Description Outlook Web Access OWA is a feature of Microsoft Exchange Server 2003. By using OWA, a server that is runni...

CVE-2003-0904

Microsoft Exchange 2003 and Outlook Web Access OWA, when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Servic...

Microsoft Security Bulletin MS04-002

Microsoft Security Bulletin MS04-002 Print Vulnerability in Exchange Server 2003 Could Lead to Privilege Escalation 832759 Issued: January 13, 2004 Version: 1.0 Summary Who should read this document: System administrators who have servers that are running Microsoft® Outlook® Web Access for...

Microsoft Exchange Server 2003 Outlook Web Access Random Mailbox Access Vulnerability

Description A vulnerability has been reported in Exchange Server 2003 with Outlook Web Access OWA configured. Exploitation of this vulnerability could allow an authenticated OWA user to connect to another user's OWA mailbox. Technologies Affected Microsoft Exchange Server 2003 Recommendations Blo...

CVE-2003-0904

Microsoft Exchange 2003 and Outlook Web Access OWA, when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Servic...

CVE-2003-0904

Summary: CVE-2003-0904 affects Microsoft Exchange Server 2003 with Outlook Web Access (OWA) when NTLM is used. A flaw in HTTP connection reuse between front-end and back-end servers (NTLM-authenticated OWA) can cause a user to be connected to another user’s mailbox if Kerberos is disabled or fall...

CVE-2003-0712

Cross-site scripting XSS vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access OWA allows remote attackers to execute arbitrary web script...

CVE-2003-0712

Cross-site scripting XSS vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access OWA allows remote attackers to execute arbitrary web script...

Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting Attack (Microsoft Security Bulletin MS03-047)

From Microsoft Security Bulletin MS03-047: A cross-site scripting XSS vulnerability results due to the way that Outlook Web Access OWA performs HTML encoding in the Compose New Message form. An attacker could seek to exploit this vulnerability by having a user run script on the attacker's behalf...

Microsoft Outlook Web Access (OWA) contains cross-site scripting vulnerability in the "Compose New Message" form

Overview There is a cross-site scripting vulnerability in Microsoft Outlook Web Access. Description The "Compose New Message" form of the Outlook Web Access OWA component of Microsoft Exchange 5.5 contains a cross-site scripting vulnerability. For more information about cross-site scripting...

Domain User Credentials access via OWA XSS

On my previous post about OWA XSS I talked about Cross Site Scripting in the attachment field of a mail. The XSS is not in the attachment, is in the body of the message. Sorry, I need to sleep... Please notice: not in the attachment, in the BODY. To make it clear to understand I have just publish...