OU
Email
Outlook
On CISA KEVExploited in the wild
125
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 44Medium 32Low 0
Watch
Add Outlook to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-0121 | – | Apr 15 | Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which… Affected: 2002 |
| CVE-2003-1378 | – | Dec 31 | Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the… Affected: 2000; 2000; 2000 |
| CVE-2003-0007 | – | Feb 7 | Microsoft Outlook 2002 does not properly handle requests to encrypt email messages with V1 Exchange Server Security certificates, which causes Outlook to send the email in… Affected: 2002; 2002; 2002 |
| CVE-2002-2101 | – | Dec 31 | Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of… Affected: 2002 |
| CVE-2002-2100 | – | Dec 31 | Microsoft Outlook 2002 allows remote attackers to embed bypass the file download restrictions for attachments via an HTML email message that uses an IFRAME to reference malicious… Affected: 2000; 2002 |
| CVE-2002-1255 | – | Dec 18 | Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using… Affected: 2002; 2002; 2002 |
| CVE-2002-0481 | – | Aug 12 | An interaction between Windows Media Player (WMP) and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute Javascript via an IFRAME in an HTML… Affected: 2002 |
| CVE-2002-1056 | – | May 16 | Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text… Affected: 2000; 2002 |
| CVE-2001-0538 | – | Aug 14 | Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTML e-mail message or web page Affected: through 2002 |
| CVE-2001-1088 | – | Jun 5 | Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when… Affected: 97; 98; 2000 |
| CVE-2001-0322 | – | Jun 2 | MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a script that creates and deletes… Affected: 2000 |
| CVE-2001-0145 | – | May 3 | Buffer overflow in VCard handler in Outlook 2000 and 98, and Outlook Express 5.x, allows an attacker to execute arbitrary commands via a malformed vCard birthday field Affected: 98; 2000 |
| CVE-2000-0753 | – | Oct 20 | The Microsoft Outlook mail client identifies the physical path of the sender's machine within a winmail.dat attachment to Rich Text Format (RTF) files Affected: 97; 98; 2000 |
| CVE-2000-0756 | – | Oct 20 | Microsoft Outlook 2000 does not properly process long or malformed fields in vCard (.vcf) files, which allows attackers to cause a denial of service Affected: 98; 2000 |
| CVE-2000-0621 | – | Jul 20 | Microsoft Outlook 98 and 2000, and Outlook Express 4.0x and 5.0x, allow remote attackers to read files on the client's system via a malformed HTML message that stores files… Affected: 97; 98; 2000 |
| CVE-2000-0567 | – | Jul 18 | Buffer overflow in Microsoft Outlook and Outlook Express allows remote attackers to execute arbitrary commands via a long Date field in an email header, aka the "Malformed E-mail… Affected: 97; 98; 2000 |
| CVE-2000-0524 | – | Jun 5 | Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From Affected: 97 |
| CVE-2000-0415 | – | May 12 | Buffer overflow in Outlook Express 4.x allows attackers to cause a denial of service via a mail or news message that has a .jpg or .bmp attachment with a long file name Affected: 98 |
| CVE-2000-0419 | – | May 11 | The Office 2000 UA ActiveX Control is marked as "safe for scripting," which allows remote attackers to conduct unauthorized activities via the "Show Me" function in Office Help,… Affected: 2000 |
| CVE-2000-0216 | – | Feb 29 | Microsoft email clients in Outlook, Exchange, and Windows Messaging automatically respond to Read Receipt and Delivery Receipt tags, which could allow an attacker to flood a mail… Affected: All versions, or not specified |
| CVE-2000-0160 | – | Feb 21 | The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that… Affected: All versions, or not specified |
| CVE-2000-0329 | – | Nov 11 | A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka the "Active Setup Control"… Affected: 98; 2000 |
| CVE-1999-1164 | – | Jun 25 | Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers, which causes Outlook to hang Affected: 97; 98; 2000 |
| CVE-1999-0384 | – | Jan 1 | The Forms 2.0 ActiveX control (included with Visual Basic for Applications 5.0) can be used to read text from a user's clipboard when the user accesses documents with ActiveX… Affected: 98 |
| CVE-1999-0519 | – | Jan 1 | A NETBIOS/SMB share password is the default, null, or missing Affected: 2000 |