Microsoft Exchange Server vulnerabilities, page 3
254 vulnerabilities
Known vulnerabilities in Microsoft Exchange Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27065microsoftexchange_server+25KEVRansomware
EPSS score99.88%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-24085microsoftexchange_server+4EPSS score4.63%
Microsoft Exchange Server Spoofing VulnerabilityCVE-2021-28481microsoftexchange_server+5EPSS score36.24%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-28482microsoftexchange_server+5EPSS score83.21%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-28483microsoftexchange_server+5EPSS score1.20%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-28480microsoftexchange_server+5EPSS score71.23%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-34470microsoftexchange_server+3EPSS score4.38%
Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2021-34523microsoftexchange_server+5KEVRansomwareEPSS score99.99%
Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2021-34453microsoftexchange_server+4EPSS score2.83%
Microsoft Exchange Server Denial of Service VulnerabilityCVE-2021-34473microsoftexchange_server+5KEVRansomwareEPSS score100.00%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-33766microsoftexchange_server+5KEVEPSS score98.18%
Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2021-33768microsoftexchange_server+4EPSS score1.23%
Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2015-2544microsoftexchange_serverEPSS score9.48%
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."CVE-2015-2359microsoftexchange_serverEPSS score11.09%
Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."CVE-2015-2505microsoftexchange_serverEPSS score18.24%
Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability."CVE-2015-2543microsoftexchange_serverEPSS score9.48%
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."CVE-2015-1631microsoftexchange_serverEPSS score9.15%
Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability."CVE-2015-1771microsoftexchange_serverEPSS score5.75%
Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."CVE-2015-1629microsoftexchange_serverEPSS score8.88%
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."CVE-2015-1630microsoftexchange_serverEPSS score8.88%
Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."