Microsoft Outlook Web Access Remote Script Injection Vulnerability

Description Microsoft Outlook Web Access is prone to a script-injection vulnerability because the application fails to properly handle specially crafted email attachments. To exploit this issue, attackers must send specially crafted files through email messages to users of the affected applicatio...

CVE-2007-1941

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

CVE-2007-1941

Cross-site scripting XSS vulnerability in the Active Content Filter feature in Domino Web Access DWA in IBM Lotus Notes before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via a multipart/related e-mail message, a different issue than CVE-2006-4843...

IBM Lotus Domino Web Access EMAIL消息HTML注入漏洞

IBM Lotus Domino Web Access是一款基于消息和Lotus Domino服务器的合作接口。 IBM Lotus Domino Web Access存在跨站脚本问题，远程攻击者可以利用漏洞获得目标用户敏感信息。 问题是由于不正确EMAIL消息内容中的HTML数据，虽然WEB访问具有部分HTML和脚本代码过滤功能，但部分代码序列可用于绕过过滤和成功执行JavaScript代码。 IBM Lotus Domino 7.0.2 IBM Lotus Domino 7.0.1 IBM Lotus Domino 7.0 IBM Lotus Domino 6.5.5 FP2 IBM...

Lotus Domino multiple security vulnerabilities

LDAP Server heap overflow, Web access crossite scripting. Buffer overflow in IMAP CRAM-MD5 authentication...

Hidden ASP the back door of the three methods-vulnerability warning-the black bar safety net

1, The establishment of a non-standard directory: mkdir images..\ A copy of the ASP Trojan to the directory: copy c:\inetpub\wwwroot\news.asp c:\inetpub\wwwroot\images..\news.asp Through the web Access ASP Trojan: http://ip/images../news.asp?action=login How to delete a non-standard directory:...

T-Com Speedport ADSL router unauthorized access

Constant Cookie value is set for Web access verification...

Chetcpasswd本地权限提升漏洞

Chetcpasswd是一个允许用户通过Web更改自己Squid及Web访问口令的工具。 Chetcpasswd在处理参数时存在漏洞，本地攻击者可能利用此漏洞提升自己权限。 如果配置为使用postchange和alertemail的话，或在更改口令后将新的passwd文件拷贝到旧的passwd文件，chetcpasswd就可能不安全地执行外部程序，允许本地攻击者获得root用户权限。但要利用这个漏洞要求攻击者在服务器上拥有有效的shell帐号且知道允许使用chetcpasswd的IP地址。 CHETCPASSWD CHETCPASSWD 2.4.1...

Microsoft Exchange Server OWA脚本注入漏洞（MS06-029）

Microsoft Exchange Server是一款流行的邮件服务器。 Exchange Server在处理邮件中的脚本存在漏洞，导致脚本代码在用户机器上非授权执行。 运行Outlook Web Access OWA的Exchange Server在某些情况下没有正确的过滤邮件中的 脚本，导致脚本注入漏洞。攻击者可以通过创建有特制脚本的邮件消息来利用这个漏洞。如果运行了特制脚本的话，就会在客户端以用户的安全环境执行。利用这个漏洞需要用户交互。 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1...

Microsoft Outlook Web Access 'owalogon.asp' URL重定向漏洞

Microsoft Exchange Server是一款企业级的邮件服务程序。 Microsoft Outlook Web Access在处理URL时存在问题，远程攻击者可以利用这个漏洞重定向任意URL。 通过构建特殊URL，攻击者可以使用户重定向到任意URL，攻击者利用这个漏洞可以诱使用户访问某个页面，并可能记录密码并发送，或者下载任意文件等。 Microsoft Outlook 2003 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.microsoft.com/technet/security/ Donnie...

[SA21997] Amazing Little Poll "lp_settings.inc" Password Disclosure

TITLE: Amazing Little Poll "lpsettings.inc" Password Disclosure SECUNIA ADVISORY ID: SA21997 VERIFY ADVISORY: http://secunia.com/advisories/21997/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Amazing Little Poll 1.x...

[SA21988] CMtextS admin.txt Password Disclosure

TITLE: CMtextS admin.txt Password Disclosure SECUNIA ADVISORY ID: SA21988 VERIFY ADVISORY: http://secunia.com/advisories/21988/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: CMtextS 1.x http://secunia.com/product/11994/ DESCRIPTION: Kacper ha...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

CVE-2006-4763

IBM Lotus Domino Web Access DWA 7.0.1 does not expire a client's Lightweight Third-Party Authentication token LtpaToken upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie...

Invalid Lotus Domino Web access sesssion cookie handling

Server accepts session cookie after user logout...

[Full-disclosure] SEC Consult SA-20060613-0 :: Outlook Web Access Cross Site Scripting Vulnerability

SEC-CONSULT Security Advisory 20060613-0 ======================================================================= title: HTML Code Injection in Outlook Web Access program: Outlook Web Access vulnerable version: Exchange 2000 SP3, 2003 SP1, 2003 SP2 impact: severe homepage:...

Microsoft Exchange Outlook Web Access crossite scripting

Crossite scripting on message reading...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access OWA, allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."...

CVE-2006-1193

CVE-2006-1193 describes a script-injection (XSS) vulnerability in Microsoft Exchange Server running Outlook Web Access (OWA) across Exchange 2000 SP1–SP3. The issue arises from improper sanitization of e-mail content read via OWA, allowing a remote attacker to inject and execute HTML/script in th...

Microsoft Exchange Server Outlook Web Access Script Injection Vulnerability

Description Microsoft Exchange Server Outlook Web Access is prone to a script-injection vulnerability. A remote attacker can exploit this issue by sending a malicious email message to a vulnerable user. Technologies Affected Microsoft Exchange Server 2000 SP3 Microsoft Exchange Server 2003 SP1...