8474 matches found
Microsoft Office Excel WorksheetOptions Code Execution Vulnerability
Summary An exploitable use-after-free vulnerability exists in the mso.dll of Microsoft Office. A specially crafted XLS file can cause a use after free, resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability. Tested Versions...
Microsoft Excel CVE-2019-1446 Information Disclosure Vulnerability
Description Microsoft Excel is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Excel 2010 Service Pack 2 32-bit editions Microsoft Excel 2010 Service Pack 2 64-bit...
PT-2019-3904 · Microsoft · Office +4
Name of the Vulnerable Software and Affected Versions: Microsoft Excel versions prior to the fixed version Microsoft Office versions prior to the fixed version Microsoft Office 365 versions prior to the fixed version Microsoft SharePoint Enterprise Server versions prior to the fixed version...
Security Updates for Microsoft Office Online Server (November 2019)
The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly. An attacker cou...
Security Updates for Microsoft SharePoint Server (November 2019)
The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists when Microsoft Office does not validate URLs. An attacker could send a victim a specially crafted...
Honeywell MCR Web Controller Cross Site Scripting / Path Disclosure
Honeywell MCR Web Controller Full Path Disclosure & Cross Site Scripting Vendor Homepage: https://www.honeywell.com WebVersion: XL1000C50 EXCEL WEB 52 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C100 EXCEL WEB 104 I/O, XL1000C1000 EXCEL WEB 600 I/O, XL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C500U EXCE...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
Input validation
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
CVE-2019-17661
A CSV injection in the codepress-admin-columns aka Admin Columns plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users mig...
Oracle Outside In Excel Information Disclosure (CVE-2018-3147)
An out-of-bounds read vulnerability exists in Oracle Outside-In. The vulnerability is due to improper handling of the OfficeArtRecLen field of a GelFrame record of an Excel document. Successful exploitation could result in information disclosure which could be used to further compromise the targe...
November 5, 2019, update for Office 2016 (KB4484138)
None None...
Office for Mac Users Warned of Malicious SYLK Files
Microsoft Office for Mac users are being warned that malicious SYLK files are sneaking past endpoint defenses even when the “disable all macros without notification” is turned on. This leaves systems vulnerable to a remote, unauthenticated attackers who can execute arbitrary code. The warning com...
XML External Entity (XXE)
Apache Poi is vulnerable to XML external entity XXE. During the use of XSSFExportToXml tool to convert user-provided Microsoft Excel documents, it is possible for an attacker to parse a malicious Microsoft Excel document containing a reference to an external entity and perform requests on behalf ...
Apache POI Information Disclosure Vulnerability
Apache POI is an open source JAVA library for reading and writing Microsoft document formats . An information disclosure vulnerability exists in Apache POI 4.1.0 and earlier versions. When converting a user-supplied Microsoft Excel document using the XSSFExportToXml tool, an attacker can exploit...
Vulnerability of Microsoft Excel, Office, and Office 365 spreadsheet applications, related to object processing in memory, allows attackers to execute arbitrary code.
The vulnerability of Microsoft Excel, Office, and Office 365 packages relates to the processing of objects in memory. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...
DEBIAN-CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...