CVSS: 5.5EPSS: 5%CPEs: 20EXPL: 2CVE-2017-8537 – Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files
https://notcve.org/view.php?id=CVE-2017-8537
26 May 2017 — The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE... • https://packetstorm.news/files/id/142713 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-369: Divide By Zero CWE-476: NULL Pointer Dereference CWE-674: Uncontrolled Recursion •
CVSS: 9.3EPSS: 88%CPEs: 23EXPL: 2CVE-2017-8540 – Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability
https://notcve.org/view.php?id=CVE-2017-8540
26 May 2017 — The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than... • https://packetstorm.news/files/id/142752 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 16%CPEs: 7EXPL: 0CVE-2016-0138
https://notcve.org/view.php?id=CVE-2016-0138
14 Sep 2016 — Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability." " Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Upda... • http://www.securityfocus.com/bid/92806 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 5%CPEs: 4EXPL: 0CVE-2014-6319
https://notcve.org/view.php?id=CVE-2014-6319
11 Dec 2014 — Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote attackers to spoof the origin of e-mail messages via unspecified vectors, aka "Outlook Web App Token Spoofing Vulnerability." Outlook Web App (OWA) en Microsoft Exchange Server 2007 SP3, 2010 SP3, y 2013 SP1 y Cumulative Update 6 no valida correctamente los tokens en solicitudes, lo que permite a atacantes remotos suplantar el origen d... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 6%CPEs: 4EXPL: 0CVE-2013-5072
https://notcve.org/view.php?id=CVE-2013-5072
11 Dec 2013 — Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability." Vulnerabilidad de XSS en Outlook Web Access de Microsoft Exchange Server 2010 SP2 y SP3 y 2013 Cumulative Update 2 y 3 permite a atacantes remotos inyectar script web o HTML arbitrario a través de una URL manipulada, también conocido como "OWA XSS Vulnerabi... • http://www.securityfocus.com/bid/64085 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 25%CPEs: 4EXPL: 0CVE-2013-0418 – Oracle Outside In CorelDRAW File Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0418
17 Jan 2013 — Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be tr... • http://archives.neohapsis.com/archives/bugtraq/2013-01/0073.html •
CVSS: 7.5EPSS: 36%CPEs: 3EXPL: 0CVE-2012-4791
https://notcve.org/view.php?id=CVE-2012-4791
12 Dec 2012 — Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted RSS feed, aka "RSS Feed May Cause Exchange DoS Vulnerability." Microsoft Exchange Server 2007 SP3 y 2010 SP1 y SP2 permite a usuarios remotos autenticados provocar una denegación de servicio (bloqueo del servicio Information Store) al suscribirse a un feed RSS manipulado, también conocido como "Feed RSS puede provocar vulnerabilid... • http://www.securityfocus.com/bid/56836 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.4EPSS: 24%CPEs: 19EXPL: 0CVE-2010-1689
https://notcve.org/view.php?id=CVE-2010-1689
07 May 2010 — The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 uses predictable transaction IDs that are formed by incrementing a previous ID by 1, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerab... • http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0058.html • CWE-310: Cryptographic Issues •
CVSS: 7.4EPSS: 19%CPEs: 19EXPL: 0CVE-2010-1690
https://notcve.org/view.php?id=CVE-2010-1690
07 May 2010 — The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows Server 2008 SP2 and earlier, Windows Server 2008 R2, Exchange Server 2003 SP3 and earlier, Exchange Server 2007 SP2 and earlier, and Exchange Server 2010 does not verify that transaction IDs of responses match transaction IDs of queries, which makes it easier for man-in-the-middle attackers to spoof DNS responses, a different vulnerabi... • http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0058.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 40%CPEs: 16EXPL: 0CVE-2010-0024
https://notcve.org/view.php?id=CVE-2010-0024
14 Apr 2010 — The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query, aka "SMTP Server MX Record Vulnerability." El componente SMTP en Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP2, y Server 2008 Gold, SP2, y R2, y Exchange Server 2000 SP3, no valida adecuada... • http://www.us-cert.gov/cas/techalerts/TA10-103A.html • CWE-20: Improper Input Validation •