CVE-2005-0420

Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.

• CWE-601

• http://seclists.org/lists/fulldisclosure/2005/Feb/0106.htmlMailing List, Third Party Advisory
• http://secunia.com/advisories/14144Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/12459Exploit, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2005/0105Permissions Required
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19225Third Party Advisory, VDB Entry
• http://seclists.org/lists/fulldisclosure/2005/Feb/0106.htmlMailing List, Third Party Advisory
• http://secunia.com/advisories/14144Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/12459Exploit, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2005/0105Permissions Required
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19225Third Party Advisory, VDB Entry

Published

Apr 27, 2005

Last Modified

Jun 16, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-0414SQL injection vulnerability in post.php for MercuryBoard 1.1…
• CVE-2005-0415Multiple memory leaks in the MQL parser in Emdros before 1.1…
• CVE-2005-0416The Windows Animated Cursor (ANI) capability in Windows NT, …
• CVE-2005-0417Unknown "high risk" vulnerability in DB2 Universal Database …
• CVE-2005-0418Argument injection vulnerability in Java Web Start for J2SE …
• CVE-2005-0419Multiple heap-based buffer overflows in 3Com 3CServer allow …
• CVE-2005-0421DelphiTurk FTP 1.0 stores usernames and passwords in the pro…
• CVE-2005-0422DelphiTurk CodeBank (aka KodBank) 3.1 and earlier stores use…
• CVE-2005-0423SQL injection vulnerability in login.asp in ASPjar Guestbook…
• CVE-2005-0424Unknown vulnerability in the delete.asp program in certain v…
• CVE-2005-0425Unknown vulnerability in IBM Websphere Application Server 5.…
• CVE-2005-0426Unknown vulnerability in Solaris 8 and 9 allows remote attac…