Security Updates for Microsoft Excel Products C2R (April 2019)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited t...

Security Updates for Microsoft Office Products C2R (September 2020)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the...

Security Updates for Microsoft Excel Products C2R (November 2021)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

Security Updates for Microsoft Office Products C2R (November 2021)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

Security Updates for Microsoft Office Products C2R (March 2021)

The Microsoft Office Products are missing security updates. They are affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-24108, CVE-2021-27058 C Tenable Network Security, Inc. The descriptiv...

Security Updates for Microsoft Excel Products (January 2022)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerabilities: - Two remote code execution vulnerabilities. An attacker can exploit these to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-21840, CVE-2022-21841...

Security Updates for Microsoft Excel Products (May 2021)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-31175, CVE-2021-31177,...

Security Updates for Outlook (April 2021)

The Microsoft Outlook application installed on the remote host is missing security updates. It is, therefore, affected by a memory corruption vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable...

CVE-2020-16955

CVE-2020-16955 is an elevation-of-privilege vulnerability in Microsoft Office Click-to-Run (C2R) AppVLP, caused by how C2R handles certain files. An attacker could exploit this by convincing a user to open a specially crafted file to gain higher privileges. The vulnerability affects Microsoft Off...

Security Feature Bypass Vulnerability for Word (June 2020)

The Microsoft Word Products is missing a security update, and Therefore is affected by a security feature bypass vulnerability. An attacker who exploited this vulnerability could cause a system to load remote images which could disclose the IP address of the targeted system to the attacker. C...

Security Updates for Microsoft Office Products (February 2020) (deprecated)

This plugin has been deprecated to be brought in line with Tenable's C2R plugin policy. Pleas use smbntms22marvisioc2r.nasl instead. %NASLMINLEVEL 70300 C Tenable, Inc. @DEPRECATED@ Disabled on 2022/06/09. Deprecated by smbntms20fedofficec2r.nasl. include'deprecatednasllevel.inc';...

Information disclosure

Microsoft Office 2016 Click-to-Run C2R allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability"...

CVE-2017-11939

CVE-2017-11939 affects Microsoft Office 2016 (Click-to-Run). The vulnerability is an information-disclosure flaw stemming from DRM copy/paste enforcement, potentially leaking a user’s private data (e.g., private key) from the certificate store or plaintext from DRM-protected emails/drafts. Affect...

CVE-2017-11939

Microsoft Office 2016 Click-to-Run C2R allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, aka "Microsoft Office Information Disclosure Vulnerability"...

CVE-2017-11935

CVE-2017-11935 is a Microsoft Office remote code execution vulnerability affecting Microsoft Excel in Office 2016 Click-to-Run. The issue stems from how Excel/Office handles objects in memory, allowing an attacker to craft an Excel document that triggers the flaw and executes arbitrary code in th...

CVE-2017-11884

Technical details about CVE-2017-11884 are not publicly provided in the connected documents; no specific affected products, versions, exploit vectors, or remediation are disclosed here. Monitor for updates.

Remote code execution

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

CVE-2016-0137

CVE-2016-0137 describes an information-disclosure/ASLR-bypass vulnerability in the Microsoft Office Click-to-Run (C2R) components for Office 2013 SP1 and Office 2016. The issue allows a local attacker with logon privileges to bypass ASLR by executing a specially crafted application, potentially l...