CVE-2007-2225

A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain...

CVE-2007-2225

CVE-2007-2225 involves a cross-domain information disclosure in the MHTML URI handler used by Outlook Express 6 and Windows Mail (on Windows Vista). The vulnerability arises when the MHTML protocol handler processes HTTP headers, causing IE to bypass domain restrictions and potentially disclose d...

Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)

Binary data 4092.prm...

Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)

Binary data 4093.prm...

Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)

Binary data 4088.prm...

MS07-034: Cumulative Security Update for Outlook Express and Windows Mail (929123)

The remote host is running a version of Microsoft Outlook Express with several security flaws that could allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to send a malformed email to a victim on the remote host and have him open it. C...

Cumulative Security Update for Microsoft Outlook Express and Windows Mail (929123)

Binary data 4090.prm...

Microsoft Outlook Express Content Disposition Parsing Information Disclosure Vulnerability

Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim's browser. Attackers could exploit this issue to access sensitive...

Microsoft Outlook Express MHTML URL Parsing Information Disclosure Vulnerability

Description Outlook Express is prone to a cross-domain information-disclosure vulnerability. This vulnerability may let a malicious website access properties of a site in an arbitrary external domain in the context of the victim user's browser. Attackers could exploit this issue to gain access to...

Microsoft Security Bulletin MS07-034 - Critical Cumulative Security Update for Outlook Express and Windows Mail (929123)

Microsoft Security Bulletin MS07-034 - Critical Cumulative Security Update for Outlook Express and Windows Mail 929123 Published: June 12, 2007 Version: 1.1 General Information Executive Summary This critical security update resolves two privately reported and two publicly disclosed...

Microsoft Html Popup / Outlook Express Address Book ActiveX DoS

Crash on element displaying...

IE 6 / MS Office Outlook Express Address Book Activex DoS

IE 6 / MS Office Outlook Express Address Book Activex DoS Affected Software : MS Internet Explorer 6.x Overview: ----------------- when a browser use MS outlook Express Address book ActiveX , crash the browser immediately. An attacker can exploit this issue to trigger denial-of-service conditions...

CVE-2005-4840

The CVE-2005-4840 issue affects the Outlook Express Address Book control when used with Internet Explorer 6. The vulnerability arises from exploiting the OutlookExpress.AddressBook COM object in IE, leading to a NULL dereference and a browser crash (denial of service). Connected advisories corrob...

CVE-2005-4840

The Outlook Express Address Book control, when using Internet Explorer 6, allows remote attackers to cause a denial of service NULL dereference and browser crash by creating the OutlookExpress.AddressBook COM object, which is not intended for use within Internet Explorer...

CVE-2007-2694

CVE-2007-2694 concerns multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server. Affected products span BEA WebLogic Express and WebLogic Server versions 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA. The root cause is improper handli...

CVE-2007-2697

The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2592

Multiple cross-site scripting XSS vulnerabilities in Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allow remote attackers to inject arbitrary web script or HTML via the 1 username...

CVE-2007-2590

Nokia Intellisync Mobile Suite 6.4.31.2, 6.6.0.107, and 6.6.2.2, possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express, allows remote attackers to obtain user names and other sensitive information via a direct request to 1 usrmgr/userList.asp or 2...

CVE-2007-2590

The CVE-2007-2590 entry affects Nokia Intellisync Mobile Suite versions 6.4.31.2, 6.6.0.107, and 6.6.2.2, with possible involvement of Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express. Affected component/pages are the direct requests to usrmgr/userList.asp and usrmgr/us...