CVE-2007-0220

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

• CWE-79

• http://secunia.com/advisories/25183Third Party Advisory
• http://www.kb.cert.org/vuls/id/124113Third Party Advisory, US Government Resource
• http://www.osvdb.org/34389Broken Link
• http://www.securityfocus.com/archive/1/468871/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/23806Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1018015Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA07-128A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2007/1711Permissions Required
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33887Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371Third Party Advisory
• http://secunia.com/advisories/25183Third Party Advisory
• http://www.kb.cert.org/vuls/id/124113Third Party Advisory, US Government Resource
• http://www.osvdb.org/34389Broken Link
• http://www.securityfocus.com/archive/1/468871/100/200/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/23806Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1018015Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA07-128A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2007/1711Permissions Required
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33887Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371Third Party Advisory

Published

May 8, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0214The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Wind…
• CVE-2007-0215Stack-based buffer overflow in Microsoft Excel 2000 SP3, 200…
• CVE-2007-0216wkcvqd01.dll in Microsoft Works 6 File Converter, as used in…
• CVE-2007-0217The wininet.dll FTP client code in Microsoft Internet Explor…
• CVE-2007-0218Microsoft Internet Explorer 5.01 and 6 allows remote attacke…
• CVE-2007-0219Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM …
• CVE-2007-0221Integer overflow in the IMAP (IMAP4) support in Microsoft Ex…
• CVE-2007-0222Directory traversal vulnerability in the EmChartBean server …
• CVE-2007-0223SQL injection vulnerability in shared/code/cp_functions_down…
• CVE-2007-0224SQL injection vulnerability in shopgiftregsearch.asp in VP-A…
• CVE-2007-0225Cross-site scripting (XSS) vulnerability in shopcustadmin.as…
• CVE-2007-0226SQL injection vulnerability in wbsearch.aspx in uniForum 4 a…