Filtered by vendor Microsoft Subscriptions
Filtered by product Outlook Web Access Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-0028 1 Microsoft 2 Exchange Server, Outlook Web Access 2024-11-21 N/A
Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."
CVE-2010-3213 1 Microsoft 1 Outlook Web Access 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in Microsoft Outlook Web Access (owa/ev.owa) 2007 through SP2 allows remote attackers to hijack the authentication of e-mail users for requests that perform Outlook requests, as demonstrated by setting the auto-forward rule.
CVE-2008-2248 1 Microsoft 2 Exchange Server, Outlook Web Access 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.
CVE-2008-2143 1 Microsoft 1 Outlook Web Access 2024-11-21 N/A
Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information.
CVE-2005-1052 1 Microsoft 2 Outlook, Outlook Web Access 2024-11-21 N/A
Microsoft Outlook 2003 and Outlook Web Access (OWA) 2003 do not properly display comma separated addresses in the From field in an e-mail message, which could allow remote attackers to spoof e-mail addresses.