KLA10598 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper same-origin policy handling can be exploited remotely via a...

Microsoft Exchange Server CVE-2015-1771 Cross Site Request Forgery Vulnerability

Description Microsoft Exchange Server is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft Exchange...

Microsoft Exchange Server Canary Parameter Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A cross-site scripting vulnerability exists in Microsoft Exchange Server's handling of user-submitted parameters, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which...

Microsoft Exchange Server ExchangeDLP Cross-Site Scripting Vulnerability

Microsoft Exchange Server is an enterprise-class mail service program. A cross-site scripting vulnerability exists in Microsoft Exchange Server ExchangeDLP's handling of user-submitted parameters, which can be exploited by a remote attacker to construct a malicious URI and trick the user into...

CVE-2015-1630

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."...

CVE-2015-1629

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."...

Spoofing

Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in errorfe.aspx in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross...

CVE-2015-1631

Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."...

CVE-2015-1629

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."...

CVE-2015-1628

CVE-2015-1628 is an XSS vulnerability in Outlook Web App (OWA) of Microsoft Exchange Server 2013 SP1 with CU7. A crafted X-OWA-Canary cookie enables a remote attacker to inject arbitrary web script/HTML via an AD.RecipientType.User action. Affected product: Microsoft Exchange Server 2013 SP1/CU7;...

CVE-2015-1630

CVE-2015-1630 is an XSS vulnerability in Outlook Web App (OWA) for Microsoft Exchange Server 2013 SP1 and Cumulative Update 7. The issue arises in processing of user-supplied URLs in OWA (Audit Report Cross Site Scripting). Attacks can inject arbitrary script/HTML via a crafted URL, impacting web...

CVE-2015-1632

The CVE-2015-1632 issue is a Cross-site scripting vulnerability in Outlook Web App (OWA) errorfe.aspx of Microsoft Exchange Server 2013 SP1 and Cumulative Update 7, exploitable via the msgParam parameter in an authError action. The root cause is improper sanitization of error messages in OWA, ena...

CVE-2015-1630

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."...

CVE-2015-1632

Cross-site scripting XSS vulnerability in errorfe.aspx in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site...

CVE-2015-1629

CVE-2015-1629 is a Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) of Microsoft Exchange Server 2013 SP1 with CU7. The root cause is improper sanitization of page content in OWA, allowing remote attackers to inject arbitrary script/HTML via a crafted URL. Affected product: Micro...

Microsoft Exchange Server CVE-2015-1632 Cross Site Scripting Vulnerability

Description Microsoft Exchange Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow...

Microsoft Exchange Error Message Cross Site Scripting (MS15-026; CVE-2015-1632)

An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by enticing a victim to open a specially crafted URL...

Microsoft Exchange Server CVE-2015-1630 Cross Site Scripting Vulnerability

Description Microsoft Exchange Server is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow...