CVE-2007-0213

CVE-2007-0213 is a remote code execution vulnerability in Microsoft Exchange Server (2000 SP3, 2003 SP1/SP2, and 2007) caused by improper handling of base64-encoded MIME content. An attacker can exploit this by sending a crafted MIME email that triggers memory corruption/decoding issues, gaining ...

CVE-2007-0221

CVE-2007-0221 is the IMAP Literal Processing Vulnerability in Microsoft Exchange Server 2000 SP3. The issue is an integer overflow in the IMAP4 service when processing literals in IMAP commands, allowing remote attackers to cause a denial of service (service hang). Connected advisories confirm th...

CVE-2006-0002

CVE-2006-0002 is a TNEF decoding vulnerability in Microsoft Outlook (2000–2003) and Microsoft Exchange Server (5.0 SP2, 5.5 SP4, 2000 SP3) where processing a crafted TNEF MIME attachment can lead to remote code execution. Root cause described as improper handling/validation of TNEF data, enabling...

CVE-2004-0574

CVE-2004-0574 affects the NNTP component in Windows NT 4.0 Server, Windows 2000 Server, Windows Server 2003, Exchange 2000/2003, enabling remote code execution via XPAT pattern handling. The issue stems from improper length validation and unchecked buffers, leading to off-by-one and heap-based ov...

CVE-2010-0024

The CVEs concern the Windows SMTP service (smtpsvc.dll) used by Microsoft Windows 2000 SP4, Windows XP SP3, Windows Server 2003 SP2, Windows Server 2008 SP2/R2, Exchange Server 2003 SP3, Exchange Server 2007 SP2, and Exchange Server 2010. CVE-2010-0024 describes a flaw in parsing DNS MX records t...

CVE-2009-0098

CVE-2009-0098 describes a memory corruption vulnerability in Microsoft Exchange Server (2000 SP3, 2003 SP2, 2007 SP1) where TNEF message properties are not interpreted correctly, allowing remote code execution via a crafted TNEF message. Microsoft published MS09-003 detailing the vulnerability an...

CVE-2010-0025

Technical details for CVE-2010-0025 are not provided in the connected documents; only related DNS spoofing CVEs are present. Monitor for updates.

CVE-2001-0146

IIS 5.0 and Exchange 2000 are vulnerable to a DoS via repeated malformed URLs that trigger a memory allocation error, disrupting IIS (and web-based mail on Exchange). The CERT/MS MS01-014 patch (and MS01-044 for IIS-only scenarios) are the remediation paths described; no exploitation details are ...

CVE-2002-0055

CVE-2002-0055 affects the SMTP service in Windows 2000, Windows XP Professional, and Exchange 2000. The vulnerability is triggered by a malformed BDAT data transfer request, allowing remote denial-of-service by an attacker. Connected documents corroborate this and reference MS02-012 (MSKB 313450)...

CVE-2009-0099

Summary of CVE-2009-0099 and related MS advisory : The CVE entry describes a literal processing vulnerability in the EMSMDB32 MAPI provider used by Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2 (via Exchange System Attendant) that could allow a remote attacker to cause a denial ...

CVE-2005-0560

CVE-2005-0560 describes a heap-based buffer overflow in the SvrAppendReceivedChunk function of xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003. The overflow is triggered by a crafted X-LINK2STATE extended verb, potentially allowing remote code execution with the server’s privile...

CVE-2006-1193

CVE-2006-1193 describes a script-injection (XSS) vulnerability in Microsoft Exchange Server running Outlook Web Access (OWA) across Exchange 2000 SP1–SP3. The issue arises from improper sanitization of e-mail content read via OWA, allowing a remote attacker to inject and execute HTML/script in th...

CVE-2003-0714

CVE-2003-0714 affects Microsoft Exchange Server’s Internet Mail Service in Exchange Server 5.5 and Exchange 2000. The issue enables remote attackers to cause a denial of service via memory exhaustion by connecting to SMTP and issuing a specific extended verb request, with a potential buffer overf...

CVE-2007-0039

CVE-2007-0039 describes a Denial of Service vulnerability in Microsoft Exchange Server caused by malformed iCal handling in the EXCDO component. The issue occurs when parsing iCal data with multiple X-MICROSOFT-CDO-MODPROPS properties; if a second MODPROPS entry is longer than the first, a NULL p...

CVE-2001-0509

CVE-2001-0509 affects RPC servers in Microsoft Exchange Server 2000 and earlier, Microsoft SQL Server 2000 and earlier, Windows NT 4.0, and Windows 2000. The vulnerability allows remote attackers to cause a denial of service via malformed inputs. No exploitation details or specific fixes are prov...

CVE-2006-0027

CVE-2006-0027 describes a remote code execution vulnerability in Microsoft Exchange Server triggered by specially crafted vCal/iCal properties in email messages. Public sources (MS06-019) document a heap overflow in MODPROP handling within VCAL requests as the underlying root cause. Affected prod...

CVE-2005-1987

CVE-2005-1987 is a remote code execution vulnerability in Microsoft Collaboration Data Objects (CDO) used by CDOSYS/CDOEX on Windows and Exchange. An unchecked buffer triggered by processing a malformed SMTP/email header (e.g., oversized Content-Type) can allow an attacker to execute arbitrary co...

CVE-2002-0368

CVE-2002-0368 concerns Microsoft Exchange 2000 where the Store Service can be overwhelmed by a crafted mail message. A remote attacker can trigger a denial of service by sending a message containing a malformed RFC 2822 attribute, causing CPU resource exhaustion and partial availability impact on...

CVE-2001-0340

An issue in Outlook Web Access (OWA) for Microsoft Exchange 2000 Server and Internet Explorer lets a malicious HTML attachment execute script when opened via OWA, with the script running under the OWA user’s privileges and potentially accessing/manipulating messages and folders on the server. Exp...

CVE-2002-0507

CVE-2002-0507 describes an authentication bypass in Microsoft Outlook Web Access (OWA) when used with RSA SecurID. Local users could bypass SecurID for a previous user by submitting multiple OWA Authentication requests using the previous user’s password, which is eventually accepted by OWA. The N...

CVE-2001-0543

The CVE-2001-0543 issue affects the NNTP service in Windows NT 4.0 and Windows 2000, where a memory leak can be triggered by processing a large number of malformed posts. This memory growth can lead to denial of service through exhaustion of resources. The provided material does not specify exact...

CVE-2007-0220

CVE-2007-0220 is a cross-site scripting vulnerability in Outlook Web Access (OWA) of Microsoft Exchange Server 2000 SP3 and Exchange Server 2003 SP1/SP2. The issue arises from an incorrectly handled UTF character set label, allowing remote attackers to run scripts, spoof content, or access inform...

CVE-2002-0049

The CVE-2002-0049 issue is validated by connected sources describing a misconfigured WinReg permissions in Microsoft Exchange 2000 System Attendant. The registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg becomes world-writeable, enabling non-admins (via remote registry ac...

CVE-2000-1139

The CVE-2000-1139 entry concerns Microsoft Exchange 2000 prior to Rev. A, where installation creates a user account with a known password. This enables potential privilege elevation (privileges granted to the created account) as described in the description. The NVD metrics assign a CVSSv2 base s...

CVE-2001-0666

Outlook Web Access (OWA) in Microsoft Exchange 2000 is affected. An authenticated user can trigger a denial of service (CPU consumption) by sending a malformed OWA request for a deeply nested folder in the user’s mailbox, exploiting a vulnerability in OWA request handling. Affected component: OWA...

CVE-2002-1873

CVE-2002-1873 affects Microsoft Exchange 2000 when used with MSRPC, allowing remote attackers to cause denial of service (crash or memory consumption) via malformed MSRPC calls. The connected Red Hat and CVE List entries mirror this description. No specific patch/version details or remediation ar...

CVE-2002-1876

CVE-2002-1876 : The provided documents identify a vulnerability in Microsoft Exchange 2000 where a remote authenticated attacker can cause a denial of service by issuing a large number of rapid requests that exhaust the licenses granted to Exchange by IIS. The core issue is described as a DoS due...

CVE-2001-1319

CVE-2001-1319 affects Microsoft Exchange 5.5 (and Exchange 2000) LDAP Service. The vulnerability allows remote attackers to cause a denial-of-service (hang/crash of the LDAP component) by sending malformed BER encodings for the LDAP filter type field, as demonstrated by PROTOS LDAPv3 tests. Impac...