CVSS: 7.8EPSS: 57%CPEs: 12EXPL: 2CVE-2006-3493 – Microsoft Word 2000/2003 - Unchecked Boundary Condition
https://notcve.org/view.php?id=CVE-2006-3493
10 Jul 2006 — Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type. NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees. Desbordamiento de búfer en la función LsCre... • https://www.exploit-db.com/exploits/2001 •
CVSS: 8.8EPSS: 74%CPEs: 5EXPL: 2CVE-2006-2492 – Microsoft Word Malformed Object Pointer Vulnerability
https://notcve.org/view.php?id=CVE-2006-2492
20 May 2006 — Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack. Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code. • http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.3EPSS: 69%CPEs: 15EXPL: 3CVE-2006-1540 – Microsoft Office Products - Array Index Bounds Error (PoC)
https://notcve.org/view.php?id=CVE-2006-1540
30 Mar 2006 — MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw d... • https://www.exploit-db.com/exploits/1615 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 60%CPEs: 13EXPL: 0CVE-2006-0009
https://notcve.org/view.php?id=CVE-2006-0009
14 Mar 2006 — Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. • http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0597.html •
CVSS: 7.8EPSS: 40%CPEs: 11EXPL: 0CVE-2006-0029
https://notcve.org/view.php?id=CVE-2006-0029
14 Mar 2006 — Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. • http://secunia.com/advisories/19138 •
CVSS: 7.8EPSS: 59%CPEs: 11EXPL: 1CVE-2006-0030 – Microsoft Excel 95 < 2004 - Malformed Graphic File Code Execution
https://notcve.org/view.php?id=CVE-2006-0030
14 Mar 2006 — Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. • https://www.exploit-db.com/exploits/27055 •
CVSS: 7.8EPSS: 56%CPEs: 6EXPL: 0CVE-2006-0031
https://notcve.org/view.php?id=CVE-2006-0031
14 Mar 2006 — Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. • http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1521.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 51%CPEs: 11EXPL: 0CVE-2006-0028 – Microsoft Excel File Format Parsing Vulnerability
https://notcve.org/view.php?id=CVE-2006-0028
14 Mar 2006 — Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via a BIFF parsing format file containing malformed BOOLERR records that lead to memory corruption, probably involving invalid pointers. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office. Exploitation requires that the attacker coerce the target into opening a malicious .... • http://secunia.com/advisories/19138 •
CVSS: 8.8EPSS: 56%CPEs: 16EXPL: 0CVE-2006-0002
https://notcve.org/view.php?id=CVE-2006-0002
10 Jan 2006 — Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation. • http://secunia.com/advisories/18368 •
CVSS: 7.8EPSS: 42%CPEs: 41EXPL: 3CVE-2005-2127 – Microsoft Visual Studio .NET - 'msdds.dll' Remote Code Execution
https://notcve.org/view.php?id=CVE-2005-2127
19 Aug 2005 — Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrat... • https://www.exploit-db.com/exploits/26167 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •