CVE-2007-0221

CVE-2007-0221 is the IMAP Literal Processing Vulnerability in Microsoft Exchange Server 2000 SP3. The issue is an integer overflow in the IMAP4 service when processing literals in IMAP commands, allowing remote attackers to cause a denial of service (service hang). Connected advisories confirm th...

CVE-2007-0039

CVE-2007-0039 describes a Denial of Service vulnerability in Microsoft Exchange Server caused by malformed iCal handling in the EXCDO component. The issue occurs when parsing iCal data with multiple X-MICROSOFT-CDO-MODPROPS properties; if a second MODPROPS entry is longer than the first, a NULL p...

CVE-2007-0220

CVE-2007-0220 is a cross-site scripting vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2000 SP3 and Exchange Server 2003 SP1/SP2. The issue arises from an incorrectly handled UTF character set label, allowing remote attackers to run scripts, spoof content, or access inform...

Microsoft Exchange Base64 MIME Message Remote Code Execution Vulnerability

Description Microsoft Exchange is prone to a remote code-execution vulnerability because the application fails to properly decode specially crafted email messages. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the vulnerable application,...

CVE-2007-0221: Integer Overflow or Wraparound

Integer overflow in the IMAP IMAP4 support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service service hang via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."...

CVE-2007-0039: NULL Pointer Dereference

The Exchange Collaboration Data Objects EXCDO functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service crash via an Internet Calendar iCal file containing multiple X-MICROSOFT-CDO-MODPROPS MODPROPS properties in which the...

CVE-2007-0213: Improper Input Validation

Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message...

CVE-2007-0220: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an...

Microsoft Exchange Server fails to properly decode MIME email messages

Overview Microsoft Exchange Server contains a remote code execution vulnerability that could enable an attacker to execute arbitrary code and gain complete control of the vulnerable system. Description Microsoft Exchange Server fails to properly process MIME messages. When an email message...

Microsoft Outlook/Exchange TNEF解码远程代码执行漏洞（MS06-003）

Microsoft Outlook和Exchange都是微软发布的邮件处理软件。 Microsoft Outlook和Microsoft Exchange Server解码传输中立封装格式（TNEF）MIME附件的方式存在漏洞，攻击者可能利用此漏洞在机器上执行任意指令。 攻击者可以创建特制的TNEF消息，如果用户打开或浏览了恶意的邮件消息或Microsoft Exchange Server Information Store处理了该特制消息的话，就可能执行任意代码。 Microsoft Exchange Server 5.5 Microsoft Exchange Server 5.0...

Microsoft Exchange Server日历远程代码执行漏洞（MS06-019）

Microsoft Exchange是一款由微软开发的邮件服务程序。 Exchange Server所提供的EXCDO和CDOEX功能没有正确地处理邮件消息中的某些iCAL和vCAL属性，远程攻击者可以向Exchange Server发送包含有特制vCAL或iCAL属性的邮件消息导致代码执行。 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1 Microsoft Exchange Server 2000 临时解决方法： NSFOCUS建议采取如下措施以降低威胁：...

Microsoft Exchange Server OWA脚本注入漏洞（MS06-029）

Microsoft Exchange Server是一款流行的邮件服务器。 Exchange Server在处理邮件中的脚本存在漏洞，导致脚本代码在用户机器上非授权执行。 运行Outlook Web Access OWA的Exchange Server在某些情况下没有正确的过滤邮件中的 脚本，导致脚本注入漏洞。攻击者可以通过创建有特制脚本的邮件消息来利用这个漏洞。如果运行了特制脚本的话，就会在客户端以用户的安全环境执行。利用这个漏洞需要用户交互。 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

CVE-2006-1193 describes a script-injection (XSS) vulnerability in Microsoft Exchange Server running Outlook Web Access (OWA) across Exchange 2000 SP1–SP3. The issue arises from improper sanitization of e-mail content read via OWA, allowing a remote attacker to inject and execute HTML/script in th...

Microsoft Security Bulletin MS06-029 Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

Microsoft Security Bulletin MS06-029 Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection 912442 Published: June 13, 2006 Version: 1.0 Summary Who should read this document: Customers who use Microsoft Exchange Server running Microsoft Outlook Web...

Microsoft Exchange Server Outlook Web Access Script Injection Vulnerability

Description Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to a vulnerable user. Technologies Affected Microsoft Exchange Server 2000 SP3 Microsoft Exchange Server 2003 SP1...

CVE-2006-1193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

Microsoft Exchange Server 2000/2003 - Outlook Web Access Script Injection

source: https://www.securityfocus.com/bid/18381/info Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to a vulnerable user. !/usr/bin/perl use Net::SMTP; my $to =...

MS06-029: Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

The remote host is running a version of the Outlook Web Access that contains cross-site scripting flaws. This vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts to...