WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product exchange server✕
Overview 279 matches · 5 in Waratek scope · 2 protected · 31 exploited · 20 CISA KEV · 43 public PoC · 36 EPSS ≥ 0.5
279matches 5in Waratek scope1.8% 2protected0.7% 31exploited11.1% 20CISA KEV7.2% 43public PoC15.4% 36EPSS ≥ 0.512.9%
Protected by Waratek 2 0.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 1.1% Outside Waratek scope 3 1.1% Not applicable 271 97.1% Withdrawn CVE 0 0.0%
Critical 27 9.7% High 121 43.4% Medium 122 43.7% Low 9 3.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 0.7% partly blocked 0 0.0% not blocked 277 99.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 31 11.1% Working exploit published 17 6.1% Proof of concept only 7 2.5% Forecast only 6 2.2% No public exploit 218 78.1%
split by peak 33 / year
Not applicable: 271Outside Waratek scope: 3No exploit published: 3Protected by Waratek: 2 Low: 9Medium: 122High: 121Critical: 27 not blocked: 277blocked by ARMR today: 2 No public exploit: 218Forecast only: 6Proof of concept only: 7Working exploit published: 17Exploited: 31
19984 Not applicable4 High2 Medium2 not blocked4 Working exploit published1 No public exploit3 19993 Not applicable3 High1 Medium2 not blocked3 No public exploit3 20003 Not applicable3 Medium3 not blocked3 No public exploit3 200110 Not applicable10 High3 Medium6 Low1 not blocked10 No public exploit10 20029 Not applicable9 High2 Medium5 Low2 not blocked9 Working exploit published1 No public exploit8 20033 Not applicable3 High1 Medium2 not blocked3 Working exploit published1 No public exploit2 20044 Not applicable4 High2 Medium2 not blocked4 Working exploit published1 No public exploit3 20057 Not applicable7 High3 Medium4 not blocked7 Working exploit published2 No public exploit5 20063 Not applicable3 High2 Low1 not blocked3 Working exploit published1 Forecast only1 No public exploit1 20075 Not applicable5 High3 Medium2 not blocked5 Working exploit published1 No public exploit4 20085 Not applicable5 Medium5 not blocked5 Working exploit published1 No public exploit4 20092 Not applicable2 High1 Medium1 not blocked2 Exploited1 No public exploit1 20106 Not applicable6 Medium6 not blocked6 Working exploit published1 No public exploit5 20110 20121 Not applicable1 Low1 not blocked1 No public exploit1 20132 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 No public exploit2 20144 Not applicable4 Medium3 Low1 not blocked4 No public exploit4 201515 Not applicable15 Medium12 Low3 not blocked15 No public exploit15 20168 Not applicable8 High2 Medium6 not blocked8 No public exploit8 201711 Not applicable11 High2 Medium9 not blocked11 Exploited1 Working exploit published3 No public exploit7 201820 No exploit published1 Not applicable19 Critical5 High4 Medium11 not blocked20 Exploited2 No public exploit18 201915 No exploit published2 Outside Waratek scope1 Not applicable12 Critical2 High4 Medium9 not blocked15 No public exploit15 202017 Protected by Waratek2 Outside Waratek scope1 Not applicable14 Critical2 High9 Medium6 blocked by ARMR today2 not blocked15 Exploited3 Working exploit published1 Forecast only1 No public exploit12 202131 Not applicable31 Critical9 High16 Medium6 not blocked31 Exploited16 Working exploit published2 Proof of concept only2 No public exploit11 202218 Not applicable18 Critical4 High10 Medium4 not blocked18 Exploited4 Working exploit published1 No public exploit13 202327 Not applicable27 Critical1 High25 Medium1 not blocked27 Exploited2 Proof of concept only2 Forecast only4 No public exploit19 20243 Not applicable3 Critical1 High2 not blocked3 Exploited1 Proof of concept only1 No public exploit1 202510 Not applicable10 High6 Medium4 not blocked10 No public exploit10 202633 Not applicable33 Critical3 High21 Medium9 not blocked33 Exploited1 Proof of concept only2 No public exploit30
1999200220052008201120142017202020232026
279 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2021-34470 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-33768 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-33766 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2021-31206 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31196 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31209 High 2021-05-11 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2021-31207 Medium 2021-05-11 Not applicable Exploited Microsoft Exchange Server Security Feature Bypass Vulnerability
CVE-2021-31198 High 2021-05-11 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31195 High 2021-05-11 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-28483 Critical 2021-04-13 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-28482 High 2021-04-13 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-28481 Critical 2021-04-13 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-28480 Critical 2021-04-13 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27078 Critical 2021-03-03 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27065 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26857 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26855 Critical 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26854 High 2021-03-03 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26412 Critical 2021-03-03 Not applicable Proof of concept only Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-24085 Medium 2021-02-25 Not applicable Proof of concept only Microsoft Exchange Server Spoofing Vulnerability
CVE-2021-1730 Medium 2021-02-25 Not applicable No public exploit <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p>
CVE-2020-17144 High 2020-12-10 Not applicable Exploited Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17143 High 2020-12-10 Not applicable Forecast only Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2020-17142 Critical 2020-12-10 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17141 High 2020-12-10 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17132 Critical 2020-12-10 Not applicable Working exploit published Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17117 High 2020-12-10 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17085 Medium 2020-11-11 Not applicable No public exploit Microsoft Exchange Server Denial of Service Vulnerability
CVE-2020-17084 High 2020-11-11 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2020-17083 Medium 2020-11-11 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2020-16969 High 2020-10-16 Not applicable No public exploit <p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p> <p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p> <p>The security update corrects the way that Exchange handles these token validations.</p>
CVE-2020-16875 High 2020-09-11 Not applicable Exploited <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>
CVE-2020-0543 Medium 2020-06-15 Outside Waratek scope No public exploit Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2020-2830 Medium 2020-04-15 Protected by Waratek No public exploit Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2020-2781 Medium 2020-04-15 Protected by Waratek No public exploit Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2020-0903 Medium 2020-03-12 Not applicable No public exploit A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
CVE-2020-0692 High 2020-02-11 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
CVE-2020-0688 High 2020-02-11 Not applicable Exploited A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
CVE-2019-3641 Medium 2019-11-13 No exploit published No public exploit Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
CVE-2019-1373 Critical 2019-11-12 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.
CVE-2019-3738 Medium 2019-09-18 No exploit published No public exploit RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-1266 Medium 2019-09-11 Not applicable No public exploit A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.
CVE-2019-1233 High 2019-09-11 Not applicable No public exploit A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.
CVE-2019-1137 Medium 2019-07-15 Not applicable No public exploit A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
CVE-2019-1136 High 2019-07-15 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
CVE-2019-1084 Medium 2019-07-15 Not applicable No public exploit An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
CVE-2019-0858 Medium 2019-04-09 Not applicable No public exploit A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
CVE-2019-0817 Medium 2019-04-09 Not applicable No public exploit A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.
CVE-2019-0724 High 2019-03-05 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.
CVE-2019-0686 High 2019-03-05 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.
CVE-2019-1559 Medium 2019-02-27 Outside Waratek scope No public exploit If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2019-0588 Medium 2019-01-08 Not applicable No public exploit An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.
CVE-2019-0586 Critical 2019-01-08 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8604 Medium 2018-12-12 Not applicable No public exploit A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8581 High 2018-11-14 Not applicable Exploited An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8448 Medium 2018-10-10 Not applicable No public exploit An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8265 High 2018-10-10 Not applicable No public exploit A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-6695 Medium 2018-10-03 No exploit published No public exploit SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.
CVE-2018-17570 Critical 2018-09-26 Not applicable No public exploit utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CVE-2018-17569 Critical 2018-09-26 Not applicable No public exploit network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CVE-2018-17568 Critical 2018-09-26 Not applicable No public exploit utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
CVE-2018-16793 High 2018-09-21 Not applicable No public exploit Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
CVE-2018-8374 Medium 2018-08-15 Not applicable No public exploit A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8302 Critical 2018-08-15 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8159 Medium 2018-05-09 Not applicable No public exploit An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8154 Critical 2018-05-09 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8151.
CVE-2018-8153 Medium 2018-05-09 Not applicable No public exploit A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8152 Medium 2018-05-09 Not applicable No public exploit An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8151 Medium 2018-05-09 Not applicable No public exploit An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154.
CVE-2018-0986 High 2018-04-04 Not applicable Exploited A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.
CVE-2018-0941 Medium 2018-03-14 Not applicable No public exploit Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is imported, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0924.
CVE-2018-0940 Medium 2018-03-14 Not applicable No public exploit Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allows an elevation of privilege vulnerability due to how links in the body of an email message are rewritten, aka "Microsoft Exchange Elevation of Privilege Vulnerability".
CVE-2018-0924 Medium 2018-03-14 Not applicable No public exploit Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft Exchange Server 2013 Service Pack 1, Microsoft Exchange Server 2016 Cumulative Update 7, and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how URL redirects are handled, aka "Microsoft Exchange Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0941.
CVE-2017-11932 High 2017-12-12 Not applicable No public exploit Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".
CVE-2017-8758 Medium 2017-09-13 Not applicable No public exploit Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."
CVE-2017-11761 Medium 2017-09-13 Not applicable No public exploit Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information Disclosure, aka "Microsoft Exchange Information Disclosure Vulnerability"
CVE-2017-8621 Medium 2017-07-11 Not applicable No public exploit Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to spoofing, aka "Microsoft Exchange Open Redirect Vulnerability".
CVE-2017-8560 Medium 2017-07-11 Not applicable No public exploit Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8559.
CVE-2017-8559 Medium 2017-07-11 Not applicable No public exploit Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.
CVE-2017-8540 High 2017-05-26 Not applicable Exploited The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
CVE-2017-8537 Medium 2017-05-26 Not applicable Working exploit published The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8536, CVE-2017-8539, and CVE-2017-8542.
CVE-2017-8536 Medium 2017-05-26 Not applicable Working exploit published The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVE-2017-8535 Medium 2017-05-26 Not applicable Working exploit published The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8536, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVE-2017-0110 Medium 2017-03-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."
CVE-2016-3379 Medium 2016-09-14 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."
CVE-2016-3378 High 2016-09-14 Not applicable No public exploit Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."
CVE-2016-0138 Medium 2016-09-14 Not applicable No public exploit Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."
CVE-2016-4377 High 2016-08-22 Not applicable No public exploit HPE Smart Update in Storage Sizing Tool before 13.0, Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1, Power Advisor before 7.8.2, Insight Management Sizer before 16.12.1, Synergy Planning Tool before 3.3, SAP Sizing Tool before 16.12.1, Sizing Tool for SAP Business Suite powered by HANA before 16.11.1, Sizer for ConvergedSystems Virtualization before 16.7.1, Sizer for Microsoft Exchange Server before 16.12.1, Sizer for Microsoft Lync Server 2013 before 16.12.1, Sizer for Microsoft SharePoint 2013 before 16.13.1, Sizer for Microsoft SharePoint 2010 before 16.11.1, and Sizer for Microsoft Skype for Business Server 2015 before 16.5.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-0032 Medium 2016-01-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVE-2016-0031 Medium 2016-01-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.
CVE-2016-0030 Medium 2016-01-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
CVE-2016-0029 Medium 2016-01-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.
CVE-2015-7404 Low 2015-11-14 Not applicable No public exploit IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (aka Spectrum Protect for Mail) 5.5 before 5.5.1.1, 6.1 and 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; and Tivoli Storage FlashCopy Manager for Windows (aka Spectrum Protect Snapshot) 2.x and 3.1 before 3.1.1.6, 3.2 before 3.2.1.8, and 4.1 before 4.1.4, when application tracing is configured, write cleartext passwords during changetsmpassword command execution, which allows local users to obtain sensitive information by reading the application trace output.
CVE-2015-2544 Medium 2015-09-09 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
CVE-2015-2543 Medium 2015-09-09 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
CVE-2015-2505 Medium 2015-09-09 Not applicable No public exploit Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."
CVE-2015-6557 Low 2015-08-23 Not applicable No public exploit IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
CVE-2015-4950 Medium 2015-08-23 Not applicable No public exploit The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected, which allows remote authenticated users to obtain sensitive information via a duplicate alias name.
CVE-2015-4949 Low 2015-08-23 Not applicable No public exploit IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows, a different vulnerability than CVE-2015-6557.
‹ prev page 2 of 3 next ›