CVSS: 9.3EPSS: 64%CPEs: 15EXPL: 0CVE-2010-0264
https://notcve.org/view.php?id=CVE-2010-0264
Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability." Microsoft Office Excel 2002 SP3, Office 2004 y 2008 para Mac y el Conversor de Formatos de Ficheros Open XML -Open XML File Format Converter- para Mac, no analizan adecuadamente los formatos de fichero Excel, esto permite a atacantes remotos ejecutar código de su elección a través de una hoja manipulada. También se conoce como "Vulnerabilidad de análisis de documento en Microsoft Office Excel DbOrParamQry" • http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7888 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 86%CPEs: 15EXPL: 0CVE-2010-0263 – Microsoft Office Excel XLSX File Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0263
Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers during decompression of Open XML (.XLSX) documents, which allows remote attackers to execute arbitrary code via a crafted document that triggers access to uninitialized memory locations, aka "Microsoft Office Excel XLSX File Parsing Code Execution Vulnerability." Microsoft Office Excel 2007 SP1 y SP2; Office 2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer SP1 y SP2; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP1 y SP2; y Office SharePoint Server 2007 SP1 y SP2 no validan las cabeceras ZIP durante la descompresión de documentos Open XML (.XLSX), lo que permite a atacantes remotos ejecutar código de su elección a través de un documentos manipulado que provoca el acceso a una ubicación de memoria sin inicializar. También conocida como "Vulnerabilidad Microsoft Office Excel XLSX File Parsing Code Execution". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the decompression of XLSX files. • http://www.securityfocus.com/archive/1/509979/100/0/threaded http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html http://www.zerodayinitiative.com/advisories/ZDI-10-025 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8407 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 80%CPEs: 3EXPL: 0CVE-2010-0243
https://notcve.org/view.php?id=CVE-2010-0243
Buffer overflow in MSO.DLL in Microsoft Office XP SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Office document, aka "MSO.DLL Buffer Overflow." Desbordamiento del búfer en MSO.DLL en Microsoft Office XP SP3 y Office 2004 para Mac, permite a atacantes remotos ejecutar código de su elección a través de un documento de Office manipulado. También se conoce como "MSO.DLL Buffer Overflow". • http://www.us-cert.gov/cas/techalerts/TA10-040A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-003 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8399 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 85%CPEs: 7EXPL: 0CVE-2009-0102
https://notcve.org/view.php?id=CVE-2009-0102
Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability." Microsoft Project 2000 SR1 y 2002 SP1 y Office Project 2003 SP3 no maneja de manera apropiada la reserva de memoria para ficheros Project, lo que permite a atacantes remotos ejecutar código de su elección mediante un fichero manipulado. También conocido como "Vulnerabilidad Project Memory Validation". • http://www.us-cert.gov/cas/techalerts/TA09-342A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-074 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6298 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 30%CPEs: 12EXPL: 0CVE-2009-3131
https://notcve.org/view.php?id=CVE-2009-3131
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet with a crafted formula embedded in a cell, aka "Excel Formula Parsing Memory Corruption Vulnerability." Microsoft Office Excel v2002 SP3, v2003 SP3, y 2007 SP1 y SP2; Office v2004 y v2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer v2003 SP3; Office Excel Viewer SP1 y SP2; y Office Compatibility Pack para Word, Excel, para PowerPoint v2007 File Formats SP1 y SP2 permite a atacantes remotos ejecutar código de su elección a través de una hoja de cálculo con una fórmula manipulada embebida en una celda, como "vulnerabilidad de corrupción de memoria en el análisis de fórmulas de Excel". • http://www.securitytracker.com/id?1023157 http://www.us-cert.gov/cas/techalerts/TA09-314A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6518 • CWE-94: Improper Control of Generation of Code ('Code Injection') •