CVE-2005-0420

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/lists/fulldisclosure/2005/Feb/0106.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/14144Exploit, Third Party Advisory
http://www.securityfocus.com/bid/12459Exploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2005/0105Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/19225Third Party Advisory, VDB Entry
http://seclists.org/lists/fulldisclosure/2005/Feb/0106.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/14144Exploit, Third Party Advisory
http://www.securityfocus.com/bid/12459Exploit, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2005/0105Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/19225Third Party Advisory, VDB Entry

Timeline

Published: Apr 27, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-04212.1DelphiTurk FTP 1.0 stores usernames and passwords in the profile.dat file, which allows local users to gain privileges.CVE-2005-04222.1DelphiTurk CodeBank (aka KodBank) 3.1 and earlier stores usernames and passwords in the Codebank registry key, which allows local users to g CVE-2005-04235.0SQL injection vulnerability in login.asp in ASPjar Guestbook allows remote attackers to execute arbitrary SQL commands via the password fiel CVE-2005-04245.0Unknown vulnerability in the delete.asp program in certain versions of ASPjar Guestbook allows remote attackers to delete messages. NOTE: t CVE-2005-04255.0Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the s CVE-2005-04265.0Unknown vulnerability in Solaris 8 and 9 allows remote attackers to cause a denial of service (panic) via "Heavy UDP Usage" that triggers a CVE-2005-04275.0The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password in the miniserv.users file when building a tbz2 of CVE-2005-04285.0The DNSPacket::expand method in dnspacket.cc in PowerDNS before 2.9.17 allows remote attackers to cause a denial of service by sending a ran CVE-2005-04295.0Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attack CVE-2005-04305.0The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown game server) and possi CVE-2005-04317.5Barracuda Spam Firewall 3.1.10 and earlier does not restrict the domains that white-listed domains can send mail to, which allows members of CVE-2005-04325.0BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest wh