CVSS: 6.1EPSS: 2%CPEs: 2EXPL: 0CVE-2016-3379
https://notcve.org/view.php?id=CVE-2016-3379
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability." Vulnerabilidad de XSS en Microsoft Exchange Server 2016 Cumulative Update 1 y 2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una solicitud de invitación a reunión, vulnerabilidad también conocida como "Microsoft Exchange Elevation of Privilege Vulnerability". • http://www.securityfocus.com/bid/92836 http://www.securitytracker.com/id/1036778 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2016-0138
https://notcve.org/view.php?id=CVE-2016-0138
Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability." " Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1 y 2016 Cumulative Update 2 no analiza correctamente la gramática de mensajes de e-mail, lo que permite a usuarios remotos autenticados obtener información sensible de la aplicación de Outlook aprovechando el derecho Send As, vulnerabilidad también conocida como ""Microsoft Exchange Information Disclosure Vulnerability""." • http://www.securityfocus.com/bid/92806 http://www.securitytracker.com/id/1036778 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2016-3378 – Microsoft Exchange Open Redirect
https://notcve.org/view.php?id=CVE-2016-3378
Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability." Vulnerabilidad de redirección abierta en Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1 y 2016 Cumulative Update 2 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de una URL manipulada, vulnerabilidad también conocida como "Microsoft Exchange Open Redirect Vulnerability". Microsoft Exchange suffers from an open redirect vulnerability. • http://www.securityfocus.com/bid/92833 http://www.securitytracker.com/id/1036778 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-0028
https://notcve.org/view.php?id=CVE-2016-0028
Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability." Outlook Web Access (OWA) en Microsoft Exchange Server 2013 SP1, Cumulative Update 11 y Cumulative Update 12 y 2016 Gold y Cumulative Update 1 no restringe correctamente la carga de elementos IMG, lo que facilita a atacantes remotos rastrear usuarios a través de un mensaje de e-mail HTML manipulado, también conocida como "Microsoft Exchange Information Disclosure Vulnerability". • http://www.securitytracker.com/id/1036106 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-079 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-0029
https://notcve.org/view.php?id=CVE-2016-0029
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031. Vulnerabilidad de XSS en Outlook Web Access (OWA) en Microsoft Exchange Server 2016 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, también conocido como "Exchange Spoofing Vulnerability", una vulnerabilidad diferente a CVE-2016-0031. • http://www.securityfocus.com/bid/79889 http://www.securitytracker.com/id/1034647 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •