exploits , vulnerabilities , articles , Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site Scripting Vulnerability

Title	Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site Scripting Vulnerability
Published	2003-10-15-12:00AM
Updated	2003-10-23-08:22AM
Class	Input Validation Error
CVE	CAN-2003-0712
Remote	Yes
Local	No
Credit	The disclosure of this issue has been credited to Ory Segal of Sanctum Inc.
Vulnerable	Microsoft Exchange Server 5.5 SP4 Microsoft BackOffice 4.5 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows NT 4.0 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP6a Microsoft Exchange Server 5.5 SP3 Microsoft BackOffice 4.5 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows NT 4.0 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP6a Microsoft Exchange Server 5.5 SP2 Microsoft BackOffice 4.5 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows NT 4.0 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP6a Microsoft Exchange Server 5.5 SP1 Microsoft BackOffice 4.5 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows NT 4.0 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP6a Microsoft Exchange Server 5.5 Microsoft BackOffice 4.5 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows NT 4.0 Microsoft Windows NT 4.0 SP1 Microsoft Windows NT 4.0 SP2 Microsoft Windows NT 4.0 SP3 Microsoft Windows NT 4.0 SP4 Microsoft Windows NT 4.0 SP5 Microsoft Windows NT 4.0 SP6 Microsoft Windows NT 4.0 SP6a
Not Vulnerable	Microsoft Exchange Server 2003 Microsoft Exchange Server 2000 SP2 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 Microsoft Exchange Server 2000 SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2 Microsoft Exchange Server 2000 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP2
Code	Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: content@securitydot.net <mailto:content@securitydot.net>.
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-16 Mozilla Firefox and SeaMonkey MFSA 2009-65 through -71 Multiple Vulnerabilities
2009-12-16 Merkaartor Insecure Temporary File Creation Vulnerability
2009-12-15 TYPO3 Watchdog (aba_watchdog) Unspecified Information Disclosure Vulnerability
2009-12-15 PostgreSQL Index Function Session State Modification Local Privilege Escalation Vulnerability
2009-12-15 PostgreSQL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
2009-12-15 IBM DB2 prior to 9.5 Fix Pack 5 Multiple Unspecified Security Vulnerabilities
2009-12-15 Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability
2009-12-15 Mozilla Firefox Sage Extension RSS Feeds Cross Domain Scripting Vulnerability
2009-12-15 Adobe Reader and Acrobat (CVE-2009-4324) Remote Code Execution Vulnerability
2009-12-14 Microsoft Protected Extensible Authentication Protocol Authentication Bypass Vulnerability