CVE-2007-0213

CVE-2007-0213 is a remote code execution vulnerability in Microsoft Exchange Server (2000 SP3, 2003 SP1/SP2, and 2007) caused by improper handling of base64-encoded MIME content. An attacker can exploit this by sending a crafted MIME email that triggers memory corruption/decoding issues, gaining ...

CVE-2008-2248

CVE-2008-2248 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw stems from insufficient validation of HTML when rendering emails, enabling an attacker to inject script or HTML via unspecified HTML in messages and potentially perfo...

CVE-2016-0138

CVE-2016-0138 affects Microsoft Exchange Server components across multiple versions (2007 SP3, 2010 SP3, 2013 SP1, 2013 CU12/CU13, 2016 CU1/CU2). The issue stems from misparsing of unstructured email content, which could allow remote authenticated attackers to disclose sensitive information from ...

CVE-2010-0024

The CVEs concern the Windows SMTP service (smtpsvc.dll) used by Microsoft Windows 2000 SP4, Windows XP SP3, Windows Server 2003 SP2, Windows Server 2008 SP2/R2, Exchange Server 2003 SP3, Exchange Server 2007 SP2, and Exchange Server 2010. CVE-2010-0024 describes a flaw in parsing DNS MX records t...

CVE-2010-3937

CVE-2010-3937 affects Microsoft Exchange Server 2007 SP2 on x64. The vulnerability is in RPC processing that allows a remote authenticated attacker to trigger a denial of service, causing an infinite loop and MSExchangeIS outage. Multiple sources (MS10-106) indicate this can be exploited via spec...

CVE-2009-0098

CVE-2009-0098 describes a memory corruption vulnerability in Microsoft Exchange Server (2000 SP3, 2003 SP2, 2007 SP1) where TNEF message properties are not interpreted correctly, allowing remote code execution via a crafted TNEF message. Microsoft published MS09-003 detailing the vulnerability an...

CVE-2010-1690

CVE-2010-1690 describes a DNS spoofing vulnerability in the Windows SMTP/Exchange DNS handling: smtpsvc.dll before 6.0.2600.5949 does not verify that DNS response transaction IDs match the corresponding query IDs, enabling potential MITM spoofing of DNS responses. Affected products span Windows 2...

CVE-2012-4791

CVE-2012-4791 affects Microsoft Exchange Server 2007 SP3 and 2010 SP1/SP2. The vulnerability lies in RSS feed processing, where remote authenticated users can subscribe to a crafted RSS feed to cause an Information Store service hang, resulting in a denial of service. Public documents describe th...

CVE-2010-0025

Technical details for CVE-2010-0025 are not provided in the connected documents; only related DNS spoofing CVEs are present. Monitor for updates.

CVE-2014-6319

CVE-2014-6319 affects Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 plus CU6. The root cause is improper validation of tokens in requests, enabling remote attackers to spoof the origin of e‑mail messages. Documented affected versions align with MS14-075 guida...

CVE-2010-1689

The Red Hat and NVD entries confirm concrete details for CVE-2010-1689 and CVE-2010-1690: the DNS handling in smtpsvc.dll on Windows and Exchange product lines prior to specific builds uses predictable DNS transaction IDs (CVE-2010-1689) and does not verify that response IDs match queries (CVE-20...

CVE-2013-0418

Oracle Outside In Technology in Oracle Fusion Middleware 8.3.7 and 8.4 contains a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) when processing the table header's field count, which can be triggered remotely to potentially execute arbitrary code. The vulnerability i...

CVE-2008-2247

CVE-2008-2247 is a cross-site scripting vulnerability in Outlook Web Access (OWA) for Microsoft Exchange Server 2003 SP2. The flaw arises from insufficient validation of e-mail fields when opening mail within an OWA client, allowing an attacker to inject arbitrary script and potentially elevate p...

CVE-2009-0099

Summary of CVE-2009-0099 and related MS advisory : The CVE entry describes a literal processing vulnerability in the EMSMDB32 MAPI provider used by Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2 (via Exchange System Attendant) that could allow a remote attacker to cause a denial ...

CVE-2007-0039

CVE-2007-0039 describes a Denial of Service vulnerability in Microsoft Exchange Server caused by malformed iCal handling in the EXCDO component. The issue occurs when parsing iCal data with multiple X-MICROSOFT-CDO-MODPROPS properties; if a second MODPROPS entry is longer than the first, a NULL p...

CVE-2010-2091

Microsoft Outlook Web Access (OWA) 8.2.254.0, when used with Internet Explorer 7 on Windows Server 2003, is vulnerable to issues with the id parameter in a Folder IPF.Note action to the default URI. This may allow remote attackers to obtain sensitive information or perform cross-site scripting (X...