Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031...

CVE-2016-0031

CVE-2016-0031 describes a cross-site scripting (XSS) flaw in Microsoft Exchange Server 2016’s Outlook Web Access (OWA). The vulnerability, triggered by a crafted URL, enables remote attackers to inject arbitrary web script or HTML within OWA pages. The issue is distinct from CVE-2016-0029. Affect...

MS16-010: Security Update in Microsoft Exchange Server to Address Spoofing (3124557)

The remote Microsoft Exchange server is missing a security update. It is, therefore, affected by multiple spoofing vulnerabilities in Outlook Web Access OWA due to a failure to properly handle web requests. An attacker can exploit these vulnerabilities, via a crafted email containing a malicious...

KLA10736 Spoofing vulnerability in Microsoft Exchange Server

Improper web requests handling was found in Microsoft Exchange Server at Outlook Web Access. By exploiting this vulnerability malicious users can spoof user interface. This vulnerability can be exploited remotely via a specially designed email with malicious link. Original advisories CVE-2016-003...