Outlook Express (Microsoft) - vulnerabilities (CVEs)

45 CVEs, 0 in the last 30 days, 32 known versions, newest CVE from 2010-08-27. Vendor: Microsoft.

CVEs of Outlook Express

CVE-2010-3147 - CVSS 9.3 (critical), 2010-08-27: Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows…
CVE-2010-0816 - CVSS 9.3 (critical), 2010-05-12: Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2,…
CVE-2008-5424 - CVSS 4.3 (medium), 2008-12-11: The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages…
CVE-2008-1448 - CVSS 7.1 (high), 2008-08-13: The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet…
CVE-2007-3897 - CVSS 9.3 (critical), 2007-10-09: Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers…
CVE-2007-4040 - CVSS 8.8 (high), 2007-07-27: Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct…
CVE-2007-2227 - CVSS 4.3 (medium), 2007-06-12: The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications,"…
CVE-2007-2225 - CVSS 4.3 (medium), 2007-06-12: A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol…
CVE-2006-2386 - CVSS 6.8 (medium), 2006-12-13: Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a…
CVE-2006-2111 - CVSS 4.3 (medium), 2006-05-01: A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the…
CVE-2006-0014 - CVSS 5.1 (medium), 2006-04-12: Buffer overflow in Microsoft Outlook Express 5.5 and 6 allows remote attackers to execute arbitrary code via a crafted Windows Address Book (WAB) file…
CVE-2005-2226 - CVSS 5 (medium), 2005-07-12: Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could allow remote…
CVE-2005-1213 - CVSS 7.5 (high), 2005-06-14: Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute…
CVE-2004-2137 - CVSS 5 (medium), 2004-12-31: Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to…
CVE-2004-2694 - CVSS 5.8 (medium), 2004-12-31: Microsoft Outlook Express 6.0 allows remote attackers to bypass intended access restrictions, load content from arbitrary sources into the Outlook context,…
CVE-2004-0526 - CVSS 5 (medium), 2004-08-06: Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt"…
CVE-2004-0215 - CVSS 5 (medium), 2004-08-06: Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.
CVE-2004-0380 - CVSS 10 (critical), 2004-05-04: The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and…
CVE-2003-1378 - CVSS 8.8 (high), 2003-12-31: Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML…
CVE-2003-0300 - CVSS 5 (medium), 2003-06-16: The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size values that cause…
CVE-2003-0301 - CVSS 5 (medium), 2003-06-16: The IMAP Client for Outlook Express 6.00.2800.1106 allows remote malicious IMAP servers to cause a denial of service (crash) via certain large literal size…
CVE-2002-2202 - CVSS 3.8 (low), 2002-12-31: Outlook Express 6.0 does not delete messages from dbx files, even when a user empties the Deleted items folder, which allows local users to read other users…
CVE-2002-2164 - CVSS 5 (medium), 2002-12-31: Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link.
CVE-2002-1179 - CVSS 7.5 (high), 2002-10-28: Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digitally…
CVE-2002-0862 - CVSS 6.8 (medium), 2002-10-04: The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including…
CVE-2002-0285 - CVSS 7.5 (high), 2002-05-31: Outlook Express 5.5 and 6.0 on Windows treats a carriage return ("CR") in a message header as if it were a valid carriage return/line feed combination…
CVE-2002-0152 - CVSS 7.5 (high), 2002-04-22: Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by…
CVE-2001-1547 - CVSS 7.5 (high), 2001-12-31: Outlook Express 6.0, with "Do not allow attachments to be saved or opened that could potentially be a virus" enabled, does not block email attachments from…
CVE-2001-0945 - CVSS 5 (medium), 2001-12-03: Buffer overflow in Outlook Express 5.0 through 5.02 for Macintosh allows remote attackers to cause a denial of service via an e-mail message that contains a…
CVE-2001-0999 - CVSS 7.5 (high), 2001-09-12: Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary…
CVE-2001-1088 - CVSS 7.5 (high), 2001-06-05: Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not…
CVE-2001-0322 - CVSS 5 (medium), 2001-06-02: MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script…
CVE-2001-0145 - CVSS 7.5 (high), 2001-05-03: Buffer overflow in VCard handler in Outlook 2000 and 98, and Outlook Express 5.x, allows an attacker to execute arbitrary commands via a malformed vCard…
CVE-2001-1325 - CVSS 7.5 (high), 2001-04-20: Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the…
CVE-2000-0653 - CVSS 5 (medium), 2000-07-20: Microsoft Outlook Express allows remote attackers to monitor a user's email by creating a persistent browser link to the Outlook Express windows, aka the…
CVE-2000-0621 - CVSS 7.5 (high), 2000-07-20: Microsoft Outlook 98 and 2000, and Outlook Express 4.0x and 5.0x, allow remote attackers to read files on the client's system via a malformed HTML message…
CVE-2000-0567 - CVSS 5 (medium), 2000-07-18: Buffer overflow in Microsoft Outlook and Outlook Express allows remote attackers to execute arbitrary commands via a long Date field in an email header, aka…
CVE-2000-0415 - CVSS 5 (medium), 2000-05-12: Buffer overflow in Outlook Express 4.x allows attackers to cause a denial of service via a mail or news message that has a .jpg or .bmp attachment with a long…
CVE-2000-0105 - CVSS 5 (medium), 2000-02-01: Outlook Express 5.01 and Internet Explorer 5.01 allow remote attackers to view a user's email messages via a script that accesses a variable that references…
CVE-2000-0036 - CVSS 5 (medium), 1999-12-22: Outlook Express 5 for Macintosh downloads attachments to HTML mail without prompting the user, aka the "HTML Mail Attachment" vulnerability.
CVE-2000-0329 - CVSS 5.1 (medium), 1999-11-11: A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the…
CVE-1999-1016 - CVSS 5 (medium), 1999-08-27: Microsoft HTML control as used in (1) Internet Explorer 5.0, (2) FrontPage Express, (3) Outlook Express 5, and (4) Eudora, and possibly others, allows remote…
CVE-1999-1164 - CVSS 5 (medium), 1999-06-25: Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes…
CVE-1999-1033 - CVSS 5 (medium), 1999-05-11: Microsoft Outlook Express before 4.72.3612.1700 allows a malicious user to send a message that contains a .., which can inadvertently cause Outlook to…
CVE-1999-0967 - CVSS 10 (critical), 1997-11-01: Buffer overflow in the HTML library used by Internet Explorer, Outlook Express, and Windows Explorer via the res: local resource protocol.