Microsoft Exchange Server vulnerabilities
236 known vulnerabilities affecting microsoft/exchange_server.
Total CVEs
236
CISA KEV
20
actively exploited
Public exploits
46
Exploited in wild
29
Severity breakdown
CRITICAL27HIGH98MEDIUM105LOW6
Vulnerabilities
Page 11 of 12
CVE-2022-34692P4MEDIUMCVSS 5.3v2016v20192022-08-09
CVE-2022-34692 [MEDIUM] CWE-200 CVE-2022-34692: Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft Exchange Server Information Disclosure Vulnerability
nvd
CVE-1999-0945P4MEDIUMCVSS 5.0v5.0v5.52001-03-12
CVE-1999-0945 [MEDIUM] CWE-120 CVE-1999-0945: Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote atta
Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote attackers to conduct a denial of service via AUTH or AUTHINFO commands.
nvd
CVE-2001-0146P4MEDIUMCVSS 5.0v20002001-06-02
CVE-2001-0146 [MEDIUM] CVE-2001-0146: IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allo
IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.
nvd
CVE-2003-0712P4MEDIUMCVSS 4.3v5.52003-11-17
CVE-2003-0712 [MEDIUM] CWE-79 CVE-2003-0712: Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Mi
Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.
nvd
CVE-2001-1319P4MEDIUMCVSS 5.0v5.5v20002001-07-16
CVE-2001-1319 [MEDIUM] CVE-2001-1319: Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptio
Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite.
nvd
CVE-2018-8151P4MEDIUMCVSS 4.3v2010-sp3v2013-cumulative_update_19+4 more2018-05-09
CVE-2018-8151 [MEDIUM] CWE-119 CVE-2018-8151: An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in
An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154.
nvd
CVE-2015-1632P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1632 [MEDIUM] CWE-79 CVE-2015-1632: Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Excha
Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability."
nvd
CVE-2015-2359P4MEDIUMCVSS 4.3v20132015-06-10
CVE-2015-2359 [MEDIUM] CWE-79 CVE-2015-2359: Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 C
Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."
nvd
CVE-2015-2544P4MEDIUMCVSS 4.3v20132015-09-09
CVE-2015-2544 [MEDIUM] CWE-79 CVE-2015-2544: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
nvd
CVE-2015-2543P4MEDIUMCVSS 4.3v20132015-09-09
CVE-2015-2543 [MEDIUM] CWE-79 CVE-2015-2543: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."
nvd
CVE-2018-8374P4MEDIUMCVSS 4.3v2016-cumulative_update_10v2016-cumulative_update_92018-08-15
CVE-2018-8374 [MEDIUM] CVE-2018-8374: A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile dat
A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.
nvd
CVE-2015-1628P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1628 [MEDIUM] CWE-79 CVE-2015-1628: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability."
nvd
CVE-2015-1630P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1630 [MEDIUM] CWE-79 CVE-2015-1630: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."
nvd
CVE-2015-1629P4MEDIUMCVSS 4.3v20132015-03-11
CVE-2015-1629 [MEDIUM] CWE-79 CVE-2015-1629: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."
nvd
CVE-2013-5072P4MEDIUMCVSS 4.3v2010v20132013-12-11
CVE-2013-5072 [MEDIUM] CWE-79 CVE-2013-5072: Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2
Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."
nvd
CVE-2014-6325P4MEDIUMCVSS 4.3v20132014-12-11
CVE-2014-6325 [MEDIUM] CWE-79 CVE-2014-6325: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6326.
nvd
CVE-2014-6326P4MEDIUMCVSS 4.3v20132014-12-11
CVE-2014-6326 [MEDIUM] CVE-2014-6326: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.
nvd
CVE-2001-0509P4MEDIUMCVSS 5.0v5.0v5.5+1 more2001-09-20
CVE-2001-0509 [MEDIUM] CWE-20 CVE-2001-0509: Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL
Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs.
nvd
CVE-2020-17085P4MEDIUMCVSS 4.9v2013v2016+1 more2020-11-11
CVE-2020-17085 [MEDIUM] CVE-2020-17085: Microsoft Exchange Server Denial of Service Vulnerability
Microsoft Exchange Server Denial of Service Vulnerability
nvd
CVE-2001-0543P4MEDIUMCVSS 5.0v20002001-09-20
CVE-2001-0543 [MEDIUM] CWE-401 CVE-2001-0543: Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a de
Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts.
nvd