CVSS: 5.5EPSS: 1%CPEs: 5EXPL: 0CVE-2020-17083 – Microsoft Exchange Server Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-17083
Microsoft Exchange Server Remote Code Execution Vulnerability Vulnerabilidad de Ejecución Remota de Código de Microsoft Exchange Server Este ID de CVE es diferente CVE-2020-17084. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17083 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-16969 – Microsoft Exchange Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-16969
<p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p> <p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p> <p>The security update corrects the way that Exchange handles these token validations. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16969 •
CVSS: 9.0EPSS: 35%CPEs: 4EXPL: 1CVE-2020-16875 – Microsoft Exchange Server Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-16875
<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p> Se presenta una vulnerabilidad de ejecución de código remota en el servidor de Microsoft Exchange debido a una comprobación inapropiada de los argumentos cmdlet. • http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875 https://support.microsoft.com/en-us/help/4577352/security-update-for-exchange-server-2019-and-2016 https://srcincite.io/advisories/src-2020-0019 https://srcincite.io/pocs/cve-2020-16875.py.txt https://srcincite.io/pocs/cve-2020-16875.ps1.txt https://srcincite.io/blog/2021/01/12/making-clouds- • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-0903
https://notcve.org/view.php?id=CVE-2020-0903
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'. Existe una vulnerabilidad de tipo cross-site-scripting (XSS) cuando Microsoft Exchange Server no sanea apropiadamente una petición web especialmente diseñada para un servidor de Exchange afectado, también se conoce como "Microsoft Exchange Server Spoofing Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0903 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7252 – Unquoted service executable path
https://notcve.org/view.php?id=CVE-2020-7252
Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files. Una ruta ejecutable de servicio sin comillas en DXL Broker en McAfee Data eXchange Layer (DXL) Framework versiones 6.0.0 y anteriores, permite a usuarios locales causar una denegación de servicio (DoS) y una ejecución de archivos maliciosos por medio de archivos ejecutables cuidadosamente diseñados y nombrados. • https://kc.mcafee.com/corporate/index?page=content&id=SB10307 • CWE-250: Execution with Unnecessary Privileges CWE-428: Unquoted Search Path or Element •