CVE-2010-2091

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

• CWE-79

• http://www.exploit-db.com/exploits/12728Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511401/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511416/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511448/100/0/threadedThird Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58835VDB Entry
• http://www.exploit-db.com/exploits/12728Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511401/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511416/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/511448/100/0/threadedThird Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58835VDB Entry

Published

May 27, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2085The default configuration of ASP.NET in Microsoft .NET befor…
• CVE-2010-2086Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere App…
• CVE-2010-2087Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Ap…
• CVE-2010-2088ASP.NET in Microsoft .NET 3.5 does not properly handle an un…
• CVE-2010-2089The audioop module in Python 2.7 and 3.2 does not verify the…
• CVE-2010-2090The npb_protocol_error function in sna V5router64 in IBM Com…
• CVE-2010-2092SQL injection vulnerability in graph.php in Cacti 0.8.7e and…
• CVE-2010-2093Use-after-free vulnerability in the request shutdown functio…
• CVE-2010-2094Multiple format string vulnerabilities in the phar extension…
• CVE-2010-2095SQL injection vulnerability in index.php in CMSQlite 1.2 and…
• CVE-2010-2096Directory traversal vulnerability in index.php in CMSQlite 1…
• CVE-2010-2097The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_m…