CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-6336
https://notcve.org/view.php?id=CVE-2014-6336
Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection Vulnerability." Outlook Web App (OWA) en Microsoft Exchange Server 2013 SP1 y Cumulative Update 6 no valida debidamente los tokens de la redirección, lo que permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y suplantar el origen de los mensajes email a través de vectores no especificados, también conocido como 'Vulnerabilidad de la redirección de URL Exchange'. • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-075 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 87%CPEs: 4EXPL: 0CVE-2013-5072
https://notcve.org/view.php?id=CVE-2013-5072
Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability." Vulnerabilidad de XSS en Outlook Web Access de Microsoft Exchange Server 2010 SP2 y SP3 y 2013 Cumulative Update 2 y 3 permite a atacantes remotos inyectar script web o HTML arbitrario a través de una URL manipulada, también conocido como "OWA XSS Vulnerability". • http://www.securityfocus.com/bid/64085 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 28%CPEs: 4EXPL: 0CVE-2013-0418 – Oracle Outside In CorelDRAW File Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-0418
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be triggered using a table header with a crafted "number of fields" value. Una vulnerabilidad no especificada en el componente "Oracle Outside In Technology" de Oracle Fusion Middleware v8.3.7 y v8.4 permite afectar a la disponibilidad a atacantes, dependiendo del contexto, a través de vectores desconocidos relacionados con Outside In Filters. Se trata de una vulnerabilidad diferente a CVE-2013-0393. • http://archives.neohapsis.com/archives/bugtraq/2013-01/0073.html http://www-01.ibm.com/support/docview.wss?uid=swg21660640 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html http://www.us-cert.gov/cas/techalerts/TA13-043B.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-012 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16251 •
CVSS: 3.5EPSS: 6%CPEs: 3EXPL: 0CVE-2012-4791
https://notcve.org/view.php?id=CVE-2012-4791
Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted RSS feed, aka "RSS Feed May Cause Exchange DoS Vulnerability." Microsoft Exchange Server 2007 SP3 y 2010 SP1 y SP2 permite a usuarios remotos autenticados provocar una denegación de servicio (bloqueo del servicio Information Store) al suscribirse a un feed RSS manipulado, también conocido como "Feed RSS puede provocar vulnerabilidad DoS en Exchange". • http://www.securityfocus.com/bid/56836 http://www.us-cert.gov/cas/techalerts/TA12-346A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-080 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16158 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2012-2284
https://notcve.org/view.php?id=CVE-2012-2284
The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecified vectors. El proceso del (1) instalación and (2) actualización en EMC NetWorker Module para Microsoft Applications (NMM) v2.2.1, v2.3 anterior al build v122, y v2.4 anterior al build v375, cuando el Exchange Server es usado, permite a usuarios locales leer las credenciales del administrador en texto plano mediante vectores desconocidos vectors. • http://archives.neohapsis.com/archives/bugtraq/2012-10/0068.html http://osvdb.org/86157 http://secunia.com/advisories/50957 http://www.securityfocus.com/bid/55883 http://www.securitytracker.com/id?1027647 • CWE-255: Credentials Management Errors •