Microsoft Hotmail vulnerabilities

3 CVEs affecting Microsoft Hotmail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2000-0081, published 2000-01-10.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2000-0081, published 2000-01-10. High severity, CVSS 10.0. EPSS: 18.9% chance of exploitation in the next 30 days. Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: protocol, e.g.…
• CVE-2000-0085, published 2000-01-04. High severity, CVSS 7.5. EPSS: 14.9% chance of exploitation in the next 30 days. Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute code via the LOWSRC or DYNRC parameters in the IMG tag.
• CVE-1999-0750, published 1999-09-13. Medium severity, CVSS 5.1. EPSS: 8.7% chance of exploitation in the next 30 days. Hotmail allows Javascript to be executed via the HTML STYLE tag, allowing remote attackers to execute commands on the user's Hotmail account.