Microsoft Exchange Server vulnerabilities
219 known vulnerabilities affecting microsoft/exchange_server.
Total CVEs
219
CISA KEV
20
actively exploited
Public exploits
46
Exploited in wild
29
Severity breakdown
CRITICAL25HIGH89MEDIUM99LOW6
Vulnerabilities
Page 10 of 11
CVE-2020-0903P4MEDIUMCVSS 5.4v2016v20192020-03-12
CVE-2020-0903 [MEDIUM] CWE-79 CVE-2020-0903: A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly s
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
nvd
CVE-2019-1137P4MEDIUMCVSS 5.4v2013v2016+1 more2019-07-15
CVE-2019-1137 [MEDIUM] CWE-79 CVE-2019-1137: A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly s
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
nvd
CVE-1999-0945P4MEDIUMCVSS 5.0v5.0v5.52001-03-12
CVE-1999-0945 [MEDIUM] CWE-120 CVE-1999-0945: Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote atta
Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote attackers to conduct a denial of service via AUTH or AUTHINFO commands.
nvd
CVE-2010-3937P4MEDIUMCVSS 4.0v20072010-12-16
CVE-2010-3937 [MEDIUM] CWE-399 CVE-2010-3937: Microsoft Exchange Server 2007 SP2 on the x64 platform allows remote authenticated users to cause a
Microsoft Exchange Server 2007 SP2 on the x64 platform allows remote authenticated users to cause a denial of service (infinite loop and MSExchangeIS outage) via a crafted RPC request, aka "Exchange Server Infinite Loop Vulnerability."
nvd
CVE-2003-0712P4MEDIUMCVSS 4.3v5.52003-11-17
CVE-2003-0712 [MEDIUM] CWE-79 CVE-2003-0712: Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Mi
Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.
nvd
CVE-2001-0146P4MEDIUMCVSS 5.0v20002001-06-02
CVE-2001-0146 [MEDIUM] CVE-2001-0146: IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allo
IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.
nvd
CVE-2022-34692P4MEDIUMCVSS 5.3v2016v20192022-08-09
CVE-2022-34692 [MEDIUM] CWE-200 CVE-2022-34692: Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft Exchange Server Information Disclosure Vulnerability
nvd
CVE-2018-8151P4MEDIUMCVSS 4.3v2010-sp3v2013-cumulative_update_19+4 more2018-05-09
CVE-2018-8151 [MEDIUM] CWE-119 CVE-2018-8151: An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in
An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154.
nvd
CVE-2001-1319P4MEDIUMCVSS 5.0v5.5v20002001-07-16
CVE-2001-1319 [MEDIUM] CVE-2001-1319: Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptio
Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite.
nvd
CVE-2015-1632P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1632 [MEDIUM] CWE-79 CVE-2015-1632: Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Excha
Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability."
nvd
CVE-2015-2359P4MEDIUMCVSS 4.3v20132015-06-10
CVE-2015-2359 [MEDIUM] CWE-79 CVE-2015-2359: Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 C
Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."
nvd
CVE-2015-2544P4MEDIUMCVSS 4.3v20132015-09-09
CVE-2015-2544 [MEDIUM] CWE-79 CVE-2015-2544: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
nvd
CVE-2015-2543P4MEDIUMCVSS 4.3v20132015-09-09
CVE-2015-2543 [MEDIUM] CWE-79 CVE-2015-2543: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
nvd
CVE-2018-8374P4MEDIUMCVSS 4.3v2016-cumulative_update_10v2016-cumulative_update_92018-08-15
CVE-2018-8374 [MEDIUM] CVE-2018-8374: A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile dat
A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.
nvd
CVE-2015-1628P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1628 [MEDIUM] CWE-79 CVE-2015-1628: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability."
nvd
CVE-2015-1630P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1630 [MEDIUM] CWE-79 CVE-2015-1630: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."
nvd
CVE-2015-1629P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1629 [MEDIUM] CWE-79 CVE-2015-1629: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
nvd
CVE-2013-5072P4MEDIUMCVSS 4.3v2010v20132013-12-11
CVE-2013-5072 [MEDIUM] CWE-79 CVE-2013-5072: Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2
Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."
nvd
CVE-2014-6325P4MEDIUMCVSS 4.3v20132014-12-11
CVE-2014-6325 [MEDIUM] CWE-79 CVE-2014-6325: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6326.
nvd
CVE-2014-6326P4MEDIUMCVSS 4.3v20132014-12-11
CVE-2014-6326 [MEDIUM] CVE-2014-6326: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.
nvd