Microsoft Exchange Server CVE-2015-2544 Spoofing Vulnerability

Description Microsoft Exchange Server is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. The following versions are affected:...

Microsoft Exchange Server CVE-2015-2505 Information Disclosure Vulnerability

Description Microsoft Exchange Server is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Exchange Server 2013 Cumulative Update 8 Microsoft Exchange Server...

MS15-103: Vulnerabilities in Microsoft Exchange could allow information disclosure: September 8, 2015

Resolves a vulnerability in Microsoft Exchange Server that could allow information disclosure if Outlook Web Access OWA does not handle web server requests correctly.SummaryThis security update resolves a vulnerability in Microsoft Exchange Server that could allow information disclosure if Outloo...

KLA10658 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to spoof user interface or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper web request handling at Outlook Web Access can be...

CVE-2015-4950

The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1...

CVE-2015-4950

CVE-2015-4950 affects IBM Tivoli Storage FlashCopy Manager for Microsoft Exchange, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server, and Tivoli Storage Manager FastBack for Microsoft Exchange. The root cause is that the mailbox-restore functionality does not consiste...

Design/Logic Flaw

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before...

Design/Logic Flaw

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception...

CVE-2015-4949

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception...

CVE-2015-4949

IBM Tivoli Storage Manager products expose cleartext passwords in exception messages and traces when application tracing or GUI popups occur (CVE-2015-4949; related CVE-2015-6557). Affected: TSM for Databases (SQL Server) 7.1 before 7.1.2, TSM for Mail (Exchange) 7.1 before 7.1.2, and Tivoli Stor...

CVE-2015-2359

Cross-site scripting XSS vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."...

CVE-2015-1771

Cross-site request forgery CSRF vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."...

CVE-2015-1764

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery SSRF issue, aka "Exchange Server-Side Request Forger...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."...

Server side request forgery (ssrf)

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery SSRF issue, aka "Exchange Server-Side Request Forger...

Microsoft Exchange Server Input Validation Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. An input validation vulnerability exists in Microsoft Exchange Server, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain sensitive information or hija...

Microsoft Exchange Server Same-Origin Policy Bypass Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A same-origin policy bypass vulnerability exists in Microsoft Exchange Server, which could be exploited by a remote attacker to submit a special web application request to bypass the same-origin policy and obtain sensitive...

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Description Microsoft Exchange Server is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the same-origin policy, obtain sensitive information and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks...

Microsoft Exchange Server CVE-2015-2359 HTML Injection Vulnerability

Description Microsoft Exchange Server is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...