CVSS: 9.3EPSS: 55%CPEs: 15EXPL: 0CVE-2014-6357
https://notcve.org/view.php?id=CVE-2014-6357
11 Dec 2014 — Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 Gold and SP1, and Office Web Apps 2010 SP2 and 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Use After Free Word Remote Code Execution Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Off... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081 •
CVSS: 9.3EPSS: 31%CPEs: 8EXPL: 0CVE-2014-6364
https://notcve.org/view.php?id=CVE-2014-6364
11 Dec 2014 — Use-after-free vulnerability in Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, and SP2; and 2013 RT Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Office 2007 SP3; 2010 SP2; 2013 Gold, SP1, y SP2; y 2013 RT Gold y SP1 permite a atacantes remotos ejecutar código arbitrario a través de un documento Office manipulado, también conocido como ... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-082 •
CVSS: 9.3EPSS: 18%CPEs: 5EXPL: 0CVE-2006-1318
https://notcve.org/view.php?id=CVE-2006-1318
19 Sep 2014 — Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability." Microsoft Office 2003 SP1 y SP2, Office XP SP3, Office 2003 SP3, Office 2004 para Mac y Office X para Mac no analiza debidamente la longitud del registro, lo que permite a atacantes remotos ejecutar código arbitrario... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-038 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 25%CPEs: 7EXPL: 0CVE-2014-1756
https://notcve.org/view.php?id=CVE-2014-1756
14 May 2014 — Untrusted search path vulnerability in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1, when the Simplified Chinese Proofing Tool is enabled, allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Microsoft Office Chinese Grammar Checking Vulnerability." Vulnerabilidad de ruta de búsqueda no confiable en Microsoft Office 2007 SP3, 2010 SP1 y SP2 y 2013 Gold, SP1, RT y RT SP... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023 •
CVSS: 6.5EPSS: 18%CPEs: 2EXPL: 0CVE-2014-1808
https://notcve.org/view.php?id=CVE-2014-1808
14 May 2014 — Microsoft Office 2013 Gold, SP1, RT, and RT SP1 allows remote attackers to obtain sensitive token information via a web site that sends a crafted response during opening of an Office document, aka "Token Reuse Vulnerability." Microsoft Office 2013 Gold, SP1, RT y RT SP1 permite a atacantes remotos obtener información sensible de tokens a través de un sitio web que envía una respuesta manipulada durante la apertura de un documento Office, también conocido como 'vulnerabilidad de reuso de token.' • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-023 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 12%CPEs: 7EXPL: 0CVE-2014-1809
https://notcve.org/view.php?id=CVE-2014-1809
14 May 2014 — The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASLR Vulnerability." La libraría MSCOMCTL en Microsoft Office 2007 SP3, 2010 SP1 y SP2 y 2013 Gold, SP1, RT y RT SP1 facilita a atacantes remotos evadir el mecanismo de protección ASLR a través de un sitio web manipulado, tal y como fue demostrado activam... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-024 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 9%CPEs: 8EXPL: 0CVE-2014-2730
https://notcve.org/view.php?id=CVE-2014-2730
05 Apr 2014 — The XML parser in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013, and Office for Mac 2011, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption and persistent application hang) via a crafted XML document containing a large number of nested entity references, as demonstrated by a crafted text/plain e-mail message to Outlook, a similar issue to CVE-2003-1564. El analizador XML en Microsoft Office 2007 SP3, 2010 SP1 y ... • http://www.securityfocus.com/archive/1/531722/100/0/threaded • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 11%CPEs: 3EXPL: 0CVE-2013-5054
https://notcve.org/view.php?id=CVE-2013-5054
11 Dec 2013 — Microsoft Office 2013 and 2013 RT allows remote attackers to discover authentication tokens via a crafted response to a file-open request for an Office file on a web site, as exploited in the wild in 2013, aka "Token Hijacking Vulnerability." Microsoft Office 2013 y 2013 RT permite a atacantes remotos descubrir los tokens de autenticación a través de respuestas manipuladas hacia una petición file-open en un archivo de Office de un sitio web, tal y como se explotó activamente en 2013, también conocida como "... • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-104 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 55%CPEs: 7EXPL: 0CVE-2013-1324
https://notcve.org/view.php?id=CVE-2013-1324
13 Nov 2013 — Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Stack Buffer Overwrite Vulnerability." Desbordamiento de búfer basado en pila en Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 y SP2, 2013, y 2013 RT permite a atacantes remotos ejecutar código arbitrario a través de documentos WordPerfect (.wpd), también conocida como "Vulnerabilidad de Sobreescrit... • http://www.us-cert.gov/ncas/alerts/TA13-317A • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 55%CPEs: 18EXPL: 0CVE-2013-3889
https://notcve.org/view.php?id=CVE-2013-3889
09 Oct 2013 — Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server 2013 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability." Microsoft Excel 2007 SP3, 2010 SP1 y SP2, 2013, y 2013 RT; Office 2007 SP3, 2010 SP1 y SP2, 2013, y 2013 RT; Office para... • http://www.us-cert.gov/ncas/alerts/TA13-288A • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •