Exchange Server@2013 Security Vulnerabilities and Issues — Page 2 of Exchange Server@2013 CVE List

Lucene search

MicrosoftExchange Server2013

101 matches found

CVE•added 2020/12/10 12:15 a.m.•147 views

CVE-2020-17142

Microsoft Exchange Remote Code Execution Vulnerability

9.1CVSS9AI score0.02344EPSS

CVE•added 2020/10/16 11:15 p.m.•143 views

CVE-2020-16969

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.To exploit the vulnerability, an attacker could include specially...

7.1CVSS6.7AI score0.01608EPSS

CVE•added 2018/04/04 5:29 p.m.•138 views

CVE-2018-0986

A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpo...

9.3CVSS8.7AI score0.76022EPSS

CVE•added 2022/11/09 10:15 p.m.•133 views

CVE-2022-41078

Microsoft Exchange Server Spoofing Vulnerability

8CVSS7.7AI score0.00147EPSS

CVE•added 2022/11/09 10:15 p.m.•128 views

CVE-2022-41079

Microsoft Exchange Server Spoofing Vulnerability

8CVSS7.7AI score0.00147EPSS

CVE•added 2019/03/06 12:0 a.m.•120 views

CVE-2019-0686

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.

7.4CVSS7.5AI score0.59226EPSS

CVE•added 2020/11/11 7:15 a.m.•115 views

CVE-2020-17084

Microsoft Exchange Server Remote Code Execution Vulnerability

9CVSS9.3AI score0.01917EPSS

CVE•added 2019/11/12 7:15 p.m.•114 views

CVE-2019-1373

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

9.8CVSS9.7AI score0.12497EPSS

CVE•added 2019/04/09 9:29 p.m.•112 views

CVE-2019-0817

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.

5.8CVSS5.5AI score0.01701EPSS

CVE•added 2019/04/09 9:29 p.m.•112 views

CVE-2019-0858

6.1CVSS5.5AI score0.01701EPSS

CVE•added 2020/11/11 7:15 a.m.•103 views

CVE-2020-17083

Microsoft Exchange Server Remote Code Execution Vulnerability

5.5CVSS6.3AI score0.43395EPSS

CVE•added 2016/01/13 5:59 a.m.•101 views

CVE-2016-0030

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

6.1CVSS5.9AI score0.01465EPSS

CVE•added 2016/01/13 5:59 a.m.•100 views

CVE-2016-0032

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

6.1CVSS5.9AI score0.01465EPSS

CVE•added 2018/05/09 7:29 p.m.•100 views

CVE-2018-8154

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8151.

10CVSS6.9AI score0.18036EPSS

CVE•added 2019/07/29 2:14 p.m.•99 views

CVE-2019-1137

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

5.4CVSS5AI score0.00799EPSS

CVE•added 2020/11/11 7:15 a.m.•98 views

CVE-2020-17085

Microsoft Exchange Server Denial of Service Vulnerability

6.2CVSS6.5AI score0.04239EPSS

CVE•added 2018/10/10 1:29 p.m.•97 views

CVE-2018-8265

A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

9.3CVSS7.8AI score0.18296EPSS

CVE•added 2018/10/10 1:29 p.m.•89 views

CVE-2018-8448

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

5.8CVSS6.1AI score0.00555EPSS

CVE•added 2013/12/11 12:55 a.m.•87 views

CVE-2013-5072

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

4.3CVSS5AI score0.06639EPSS

CVE•added 2017/03/17 12:59 a.m.•87 views

CVE-2017-0110

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

6.1CVSS5.9AI score0.01205EPSS

CVE•added 2018/08/15 5:29 p.m.•87 views

CVE-2018-8302

10CVSS9.4AI score0.1694EPSS

CVE•added 2019/07/29 2:13 p.m.•86 views

CVE-2019-1136

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

8.1CVSS5.7AI score0.05403EPSS

CVE•added 2018/03/14 5:29 p.m.•85 views

CVE-2018-0940

Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumu...

6.5CVSS6.5AI score0.1153EPSS

CVE•added 2016/09/14 10:59 a.m.•83 views

CVE-2016-0138

Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging t...

4.3CVSS4.9AI score0.16066EPSS

CVE•added 2017/07/11 9:29 p.m.•83 views

CVE-2017-8560

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability...

6.1CVSS5.9AI score0.0079EPSS

CVE•added 2018/03/14 5:29 p.m.•82 views

CVE-2018-0924

Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server ...

6.5CVSS5.5AI score0.25846EPSS

CVE•added 2019/01/08 9:29 p.m.•80 views

CVE-2019-0588

An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.

6.5CVSS7AI score0.03687EPSS

CVE•added 2017/05/26 8:29 p.m.•78 views

CVE-2017-8537

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Excha...

5.5CVSS5.1AI score0.1918EPSS

CVE•added 2017/07/11 9:29 p.m.•76 views

CVE-2017-8621

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".

6.1CVSS6AI score0.00915EPSS

CVE•added 2016/09/14 10:59 a.m.•74 views

CVE-2016-3378

Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Micro...

7.4CVSS7AI score0.02934EPSS

CVE•added 2018/05/09 7:29 p.m.•72 views

CVE-2018-8151

An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154.

4.3CVSS6.1AI score0.18036EPSS

CVE•added 2015/06/10 1:59 a.m.•64 views

CVE-2015-1771

Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."

6.8CVSS7.3AI score0.02384EPSS

CVE•added 2015/06/10 1:59 a.m.•63 views

CVE-2015-2359

Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."

4.3CVSS5.9AI score0.14054EPSS

CVE•added 2018/05/09 7:29 p.m.•63 views

CVE-2018-8159

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

5.8CVSS7AI score0.00997EPSS

CVE•added 2015/06/10 1:59 a.m.•62 views

CVE-2015-1764

The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forger...

4.3CVSS6.6AI score0.09472EPSS

CVE•added 2017/09/13 1:29 a.m.•59 views

CVE-2017-11761

Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure, aka "Microsoft Exchange Information Disclosure Vulnerability"

5.3CVSS5.3AI score0.07988EPSS

CVE•added 2017/07/11 9:29 p.m.•58 views

CVE-2017-8559

6.1CVSS5.9AI score0.0079EPSS

CVE•added 2015/03/11 10:59 a.m.•56 views

CVE-2015-1631

Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."

5CVSS6.8AI score0.08599EPSS

CVE•added 2014/12/11 12:59 a.m.•54 views

CVE-2014-6319

Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability....

5CVSS6.7AI score0.05143EPSS

CVE•added 2015/09/09 12:59 a.m.•54 views

CVE-2015-2505

Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."

5CVSS5.8AI score0.1646EPSS

CVE•added 2015/03/11 10:59 a.m.•53 views

CVE-2015-1628

Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cro...

4.3CVSS5.4AI score0.06935EPSS

CVE•added 2015/09/09 12:59 a.m.•53 views

CVE-2015-2543

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

4.3CVSS5.6AI score0.08117EPSS

CVE•added 2017/05/26 8:29 p.m.•53 views

CVE-2017-8535

5.5CVSS5.1AI score0.1918EPSS

CVE•added 2017/05/26 8:29 p.m.•53 views

CVE-2017-8536

5.5CVSS5.1AI score0.1918EPSS

CVE•added 2014/12/11 12:59 a.m.•52 views

CVE-2014-6326

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.

4.3CVSS5AI score0.0513EPSS

CVE•added 2015/03/11 10:59 a.m.•51 views

CVE-2015-1632

Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Sc...

4.3CVSS5.5AI score0.06643EPSS

CVE•added 2015/03/11 10:59 a.m.•50 views

CVE-2015-1629

Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."

4.3CVSS5.4AI score0.06935EPSS

CVE•added 2015/09/09 12:59 a.m.•46 views

CVE-2015-2544

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

4.3CVSS5.6AI score0.08117EPSS

CVE•added 2015/03/11 10:59 a.m.•44 views

CVE-2015-1630

Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."

4.3CVSS5.4AI score0.06935EPSS

CVE•added 2014/12/11 12:59 a.m.•43 views

CVE-2014-6336

Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection Vu...

3.5CVSS6.6AI score0.03795EPSS

Total number of security vulnerabilities101