Security Bulletin MS01-049

---------------------------------------------------------------------- Title: Deeply-nested OWA Request Can Consume Server CPU Availability Date: 26 September 2001 Software: Exchange 2000 Impact: Denial of Service Bulletin: MS01-049 Microsoft encourages customers to review the Security Bulletin...

CVE-2001-0340

An interaction between the Outlook Web Access OWA service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically...

CVE-2001-0340

An issue in Outlook Web Access (OWA) for Microsoft Exchange 2000 Server and Internet Explorer lets a malicious HTML attachment execute script when opened via OWA, with the script running under the OWA user’s privileges and potentially accessing/manipulating messages and folders on the server. Exp...

CVE-2001-0340: Unrestricted Upload of File with Dangerous Type

An interaction between the Outlook Web Access OWA service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically...

Microsoft Exchange Outlook Web Access fails to authenticate users when searching the Global Address List

Overview Microsoft Exchange servers that offer the Outlook Web Access service are vulnerable to an information disclosure vulnerability that can reveal any email address stored in the Global Address List. Description The Outlook Web Access OWA component of Microsoft Exchange allows users to acces...

Security Bulletin MS01-047

---------------------------------------------------------------------- Title: OWA Function Allows Unauthenticated User to Enumerate Global Address List Date: 06 September 2001 Software: Exchange 5.5 Impact: Information Disclosure Bulletin: MS01-047 Microsoft encourages customers to review the...

Outlook Web Access (OWA) executes scripts contained in email attachment opened via Microsoft Internet Explorer (IE)

Overview Microsoft Outlook Web Access OWA can run malicious scripts on an Exchange server when Internet Explorer IE users open email attachments. Description OWA allows users to access their email accounts on a Microsoft Exchange server from another host through a web browser. When IE users acces...

CVE-2001-0340

An interaction between the Outlook Web Access OWA service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically...

CVE-2000-0146

The CVE-2000-0146 issue affects the Java Server in Novell GroupWise Web Access Enhancement Pack. A remote attacker can cause a denial of service by sending an excessively long URL to the servlet, leading to availability impact. Connected sources corroborate a URL-length-based DoS vector (e.g., lo...

CVE-2000-0146: Undefined Security Weakness

The Java Server in the Novell GroupWise Web Access Enhancement Pack allows remote attackers to cause a denial of service via a long URL to the servlet...

ntop.advisory.txt

================================================================================ Hackerslab bugpaper ntop web mode vulnerabliity ================================================================================ Command : /sbin/ntop -w SYSTEM : N/A INFO : ntop - display top network users -w Starts...

Novell Border Manger - Anyone can pose as an authenticated user

Info: Author: George R. Johnson Date: 07/07/00 Product: BorderManager 3.0 possibly others Vendor: Novell Problem: Unauthenticated user can web surf as any authenticated user Discussion: To provide SSO-like capabilities for customers using BorderManger proxy server and the NetWare client, Novell...

NetWin DNews 5.3 Server - Remote Buffer Overflow

NetWin DNews 5.3 Server - Remote Buffer Overflow source: https://www.securityfocus.com/bid/1172/info DNews News Server is a CGI application that gives access to auser's NNTP server over the web. There are many unchecked buffers in the program, some of which can be exploited directly from any...

CVE-2000-0124

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

CVE-2000-0124

CVE-2000-0124 affects surfCONTROL SuperScout. The vulnerability arises because it does not properly assign a category to web sites that end with a dot, which could allow bypassing web access restrictions. The NVD entry lists a low base score (CVSS2 2.1) with local attack vector, unauthenticated a...

CVE-2000-0124: Undefined Security Weakness

surfCONTROL SuperScout does not properly asign a category to web sites with a . dot at the end, which may allow users to bypass web access restrictions...

ms.exchange.outlook.javascript.txt

Date: Fri, 5 Mar 1999 11:30:56 -0000 From: Mat Newman To: "'[email protected]'" Subject: Exchange server web access You may have heard about this but... If someone is accessing Exchange server via the web then you can embed javascript into the email to get it to delete the contents of...

CVE-1999-0541

A password for accessing a WWW URL is guessable...

Security Update For Exchange Server 2013 CU6 (KB3011140)

The security update addresses the vulnerabilities by ensuring that Outlook Web Access properly validates request tokens and by ensuring that URLs are properly sanitized...

Security Update For Exchange Server 2016 CU11 (KB4487563)

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...