CVE-2015-1629

CVE-2015-1629 is a Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) of Microsoft Exchange Server 2013 SP1 with CU7. The root cause is improper sanitization of page content in OWA, allowing remote attackers to inject arbitrary script/HTML via a crafted URL. Affected product: Micro...

Microsoft Exchange Cross Site Scripting (MS15-026; CVE-2015-1630)

An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by modifying certain properties within Outlook Web App and...

Microsoft Exchange Error Message Cross Site Scripting (MS15-026; CVE-2015-1632)

An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by enticing a victim to open a specially crafted URL...

Microsoft Outlook Web Access Modified Canary Parameter Cross Site Scripting (MS15-026; CVE-2015-1628)

An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by enticing a victim to open a specially crafted URL...

MS15-026: Vulnerabilities in Exchange Server could allow elevation of privilege: March 10, 2015

None None...

Seagate Confirms NAS Zero Day, Won't Patch Until May

Seagate, over the weekend, confirmed the zero-day vulnerability in its Seagate Business Storage 2-Bay NAS boxes disclosed March 1. But in the same breath, told customers exposed to the vulnerability that a patch is still two months away. “For those customers who choose to keep their networks open...

Loxone Smart Home has multiple information disclosure vulnerabilities

Loxone Smart Home is a WEB-based application. Loxone Smart Home has multiple information disclosure vulnerabilities that could be exploited by remote attackers to obtain sensitive information...

February 10, 2015 update for Office Web Apps Server 2013 (KB2956101)

None None...

Microsoft Exchange Outlook Web App / Outlook Web Access (OWA) Detection (HTTP)

HTTP based detection of the Microsoft Exchange Outlook Web App / Outlook Web Access OWA and the Microsoft Exchange Server running this OWA application. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2014-6336

Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection...

CVE-2014-6319

Outlook Web App OWA in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability....

Spoofing

Outlook Web App OWA in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability....

Code injection

Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection...

CVE-2014-6319

Outlook Web App OWA in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability....

CVE-2014-6336

Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection...

CVE-2014-6319

CVE-2014-6319 affects Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 plus CU6. The root cause is improper validation of tokens in requests, enabling remote attackers to spoof the origin of e‑mail messages. Documented affected versions align with MS14-075 guida...

CVE-2014-6336

CVE-2014-6336 affects Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 (Exchange 2013 SP1+CU6) via an improper validation of redirection tokens in Outlook Web App (OWA), enabling remote redirection to arbitrary sites and spoofing email origin. Connected sources confirm the affected prod...

MS14-075: Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege (3009712)

The version of Microsoft Exchange installed on the remote host is affected by multiple vulnerabilities : - A token spoofing vulnerability exists due to Microsoft Outlook Web App OWA not properly validating request tokens. A remote attacker can exploit this vulnerability by convincing a user to...

Firing Range — Open Source Web App Vulnerability Scanning Tool From Google

Google on Tuesday launched a Security testing tool "Firing Range", which aimed at improving the efficiency of automated Web application security scanners by evaluating them with a wide range of cross-site scripting XSS and a few other web vulnerabilities seen in the wild. Firing Range basically...

Outlook Web App (OWA) Brute Force Utility

This module tests credentials on OWA 2003, 2007, 2010, 2013, and 2016 servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Outlook Web App OWA Brute Force Utility', 'Description' = %q This...