CVSS: 9.3EPSS: 95%CPEs: 9EXPL: 1CVE-2015-2520 – Microsoft Office 2007 - BIFFRecord Length Use-After-Free
https://notcve.org/view.php?id=CVE-2015-2520
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Vulnerabilidad en Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel para Mac 2011 y 2016, Office Compatibility Pack SP3 y Excel Viewer, permite a atacantes remotos ejecutar código arbitrario a través de un documento Office manipulado, también conocida como 'Microsoft Office Memory Corruption Vulnerability.' A use-after-free crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office 2010 or 2013. • https://www.exploit-db.com/exploits/38215 http://www.securitytracker.com/id/1033488 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 96%CPEs: 5EXPL: 1CVE-2015-2521 – Microsoft Office 2007 - OLESSDirectyEntry.CreateTime Type Confusion
https://notcve.org/view.php?id=CVE-2015-2521
Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Vulnerabilidad en Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3 y Excel Viewer, permite a atacantes remotos ejecutar código arbitrario a través de un documento Office manipulado, también conocida como 'Microsoft Office Memory Corruption Vulnerability.' A type confusion crash was observed in Microsoft Office 2007 with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office 2010 or 2013. • https://www.exploit-db.com/exploits/38216 http://www.securitytracker.com/id/1033488 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 95%CPEs: 9EXPL: 1CVE-2015-2523 – Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free
https://notcve.org/view.php?id=CVE-2015-2523
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Vulnerabilidad en Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel para Mac 2011 y 2016, Office Compatibility Pack SP3 y Excel Viewer, permite a atacantes remotos ejecutar código arbitrario a través de un documento Office manipulado, también conocida como 'Microsoft Office Memory Corruption Vulnerability.' Microsoft Excel 2007 running on Windows 2003 suffers from a use-after-free vulnerability. • https://www.exploit-db.com/exploits/38214 http://www.securitytracker.com/id/1033488 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-099 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 1%CPEs: 36EXPL: 0CVE-2015-2423
https://notcve.org/view.php?id=CVE-2015-2423
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability." Vulnerabilidad en Microsoft Windows Vista SP2, Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT Gold y 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1 e Internet Explorer 7 hasta la versión 11, permite a atacantes remotos obtener privilegios e información sensible a través de un parámetro de línea de comandos manipulado para una aplicación de Office o Notepad, según lo demostrado en una transición desde Low Integrity hasta Medium Integrity, también conocida como 'Unsafe Command Line Parameter Passing Vulnerability.' • http://www.securitytracker.com/id/1033237 http://www.securitytracker.com/id/1033239 http://www.securitytracker.com/id/1033248 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-079 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-088 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.9EPSS: 58%CPEs: 5EXPL: 0CVE-2015-2378
https://notcve.org/view.php?id=CVE-2015-2378
Untrusted search path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Microsoft Excel DLL Remote Code Execution Vulnerability." Vulnerabilidad de búsqueda no fiable de ruta en Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, y Office Compatibility Pack SP3 que permite a usuarios locales escalar privilegios, a través de un troyano DLL, en el directorio de trabajo actual, también conocida como “Vulnerabilidad de Ejecución de código Remota DLL en Microsoft Excel.” • http://www.securitytracker.com/id/1032899 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070 •