CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-1204 – Microsoft Outlook Elevation of Privilege Vulnerability
https://notcve.org/view.php?id=CVE-2019-1204
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email. This update addresses the vulnerability by ensuring Office fully validates incoming email formatting before processing message content. Existe una vulnerabilidad de elevación de privilegios cuando Microsoft Outlook inicia el procesamiento de mensajes entrantes sin una comprobación suficiente del formato de los mensajes, también se conoce como "Microsoft Outlook Elevation of Privilege Vulnerability". • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1204 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 1%CPEs: 6EXPL: 0CVE-2019-1200 – Microsoft Outlook Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-1200
A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1200 •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2019-1084
https://notcve.org/view.php?id=CVE-2019-1084
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'. Existe una vulnerabilidad de divulgación de información cuando Exchange permite la creación de entidades con nombres de visualización que tienen caracteres no imprimibles. Un atacante autenticado podría explotar esta vulnerabilidad al crear entidades con nombres de visualización no válidos que, cuando son agregados a las conversaciones, permanecen invisibles. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1084 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2019-0559
https://notcve.org/view.php?id=CVE-2019-0559
An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. Existe una vulnerabilidad de divulgación de información cuando Microsoft Outlook gestiona incorrectamente determinados tipos de mensajes. Esto también se conoce como "Microsoft Outlook Information Disclosure Vulnerability." Esto afecta a Office 365 ProPlus, Microsoft Office y Microsoft Outlook. • http://www.securityfocus.com/bid/106397 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0559 •
CVSS: 5.5EPSS: 6%CPEs: 6EXPL: 0CVE-2019-0560
https://notcve.org/view.php?id=CVE-2019-0560
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office. Existe una vulnerabilidad de divulgación de información cuando Microsoft Office muestra de manera indebida contenidos de su memoria. Esto también se conoce como "Microsoft Office Information Disclosure Vulnerability". Esto afecta a Office 365 ProPlus y Microsoft Office. • http://www.securityfocus.com/bid/106398 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0560 •