Microsoft Microsoft Exchange Server
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2019-1136 | 2010 Service Pack 3 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerabi | HIGH 8.1 | 3.4 % | ||
| CVE-2019-1084 | 2010 Service Pack 3 | An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. | MEDIUM 6.5 | 5.3 % | ||
| CVE-2019-0858 | 2019 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Micro | MEDIUM 6.1 | 2.1 % | ||
| CVE-2019-0817 | 2010 Service Pack 3 ; 2019 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Micro | MEDIUM 5.4 | 2.3 % | ||
| CVE-2019-0588 | 2010 Service Pack 3 Update Rollup 25 ; 2013 Cumulative Update 21 ; 2016 Cumulative Update 10 ; … | An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions | MEDIUM 6.5 | 4.6 % | ||
| CVE-2019-0586 | 2016 Cumulative Update 10 ; 2016 Cumulative Update 11 ; 2019 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak | CRITICAL 9.8 | 15 % | ||
| CVE-2018-8604 | 2016 Cumulative Update 10 ; 2016 Cumulative Update 11 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tamper | MEDIUM 4.3 | 2.4 % | ||
| CVE-2018-8581 | 2010 ; 2013 ; 2016 ; … | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerabi | HIGH 7.4 | 27 % | KEV | |
| CVE-2018-8448 | 2013 Cumulative Update 21 ; 2016 Cumulative Update 10 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka " | MEDIUM 5.4 | 3.2 % | ||
| CVE-2018-8265 | 2013 Cumulative Update 21 ; 2016 Cumulative Update 10 | A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft | HIGH 7.8 | 19 % | ||
| CVE-2018-8374 | 2016 Cumulative Update 10 ; 2016 Cumulative Update 9 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tamper | MEDIUM 4.3 | 3.3 % | ||
| CVE-2018-8302 | 2010 Service Pack 3 Update Rollup 23 ; 2013 Cumulative Update 20 ; 2013 Cumulative Update 21 ; … | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak | CRITICAL 9.8 | 27 % | ||
| CVE-2018-8159 | 2013 Cumulative Update 19 ; 2013 Cumulative Update 20 ; 2016 Cumulative Update 8 ; … | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka " | MEDIUM 5.4 | 3.5 % | ||
| CVE-2018-8154 | 2010 Service Pack 3 Update Rollup 21 ; 2013 Cumulative Update 19 ; 2013 Cumulative Update 20 ; … | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak | CRITICAL 9.8 | 24 % | ||
| CVE-2018-8153 | 2016 Cumulative Update 8 ; 2016 Cumulative Update 9 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Micro | MEDIUM 5.4 | 3.4 % | ||
| CVE-2018-8152 | 2016 Cumulative Update 8 ; 2016 Cumulative Update 9 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka " | MEDIUM 5.4 | 3.5 % | ||
| CVE-2018-8151 | 2010 Service Pack 3 Update Rollup 21 ; 2013 Cumulative Update 19 ; 2013 Cumulative Update 20 ; … | An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory | MEDIUM 4.3 | 8.7 % | ||
| CVE-2018-0986 | 2013 ; 2016 | A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, l | HIGH 8.8 | 63 % |