CVE-2020-17083 – Microsoft Exchange Server Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2020-17083

11 Nov 2020 — Microsoft Exchange Server Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Código de Microsoft Exchange Server Este ID de CVE es diferente CVE-2020-17084. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17083 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2020-16969 – Microsoft Exchange Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2020-16969

16 Oct 2020 —

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.

To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other t... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16969 •

CVE-2020-16875 – Microsoft Exchange Server Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2020-16875

11 Sep 2020 —

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.

An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.

The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.

Se presenta una vulnerabilidad... • https://packetstorm.news/files/id/159210 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-269: Improper Privilege Management •

CVE-2020-0903

https://notcve.org/view.php?id=CVE-2020-0903

12 Mar 2020 — A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'. Existe una vulnerabilidad de tipo cross-site-scripting (XSS) cuando Microsoft Exchange Server no sanea apropiadamente una petición web especialmente diseñada para un servidor de Exchange afectado, también se conoce como "Microsoft Exchange Server Spoofing Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0903 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2020-7252 – Unquoted service executable path

https://notcve.org/view.php?id=CVE-2020-7252

17 Feb 2020 — Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files. Una ruta ejecutable de servicio sin comillas en DXL Broker en McAfee Data eXchange Layer (DXL) Framework versiones 6.0.0 y anteriores, permite a usuarios locales causar una denegación de servicio (DoS) y una ejecución de archivos maliciosos por medio de archivos ejecutables... • https://kc.mcafee.com/corporate/index?page=content&id=SB10307 • CWE-250: Execution with Unnecessary Privileges CWE-428: Unquoted Search Path or Element •

CVE-2020-0692

https://notcve.org/view.php?id=CVE-2020-0692

11 Feb 2020 — An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. Se presenta una vulnerabilidad de elevación de privilegios en Microsoft Exchange Server, también se conoce como "Microsoft Exchange Server Elevation of Privilege Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0692 •

CVE-2020-0688 – Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2020-0688

11 Feb 2020 — A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'. Se presenta una vulnerabilidad de ejecución de código remota en el software Microsoft Exchange cuando el software no puede manejar apropiadamente los objetos en la memoria, también se conoce como "Microsoft Exchange Memory Corruption Vulnerability". This vulnerability allows remote attackers to execute arbitrary co... • https://packetstorm.news/files/id/156620 • CWE-287: Improper Authentication •

CVE-2019-1373

https://notcve.org/view.php?id=CVE-2019-1373

12 Nov 2019 — A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. Se presenta una vulnerabilidad de ejecución de código remota en Microsoft Exchange por medio de la deserialización de metadatos mediante PowerShell, también se conoce como "Microsoft Exchange Remote Code Execution Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1373 • CWE-502: Deserialization of Untrusted Data •

CVE-2019-1266

https://notcve.org/view.php?id=CVE-2019-1266

11 Sep 2019 — A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. Se presenta una vulnerabilidad de suplantación de identidad en Microsoft Exchange Server cuando Outlook Web App (OWA) no puede manejar apropiadamente las peticiones web, también se conoce como "Microsoft Exchange Spoofing Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2019-1233

https://notcve.org/view.php?id=CVE-2019-1233

11 Sep 2019 — A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'. Se presenta una vulnerabilidad de denegación de servicio en el software Microsoft Exchange Server, cuando el software no puede manejar apropiadamente los objetos en la memoria, también se conoce como "Microsoft Exchange Denial of Service Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1233 •