Overview 151 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
151matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.7%
Not applicable
150
99.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
151
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
151
100.0%
split by
peak 13 / year
19972
Not applicable2
High2
not blocked2
No public exploit2
19980
19993
Not applicable3
Medium3
not blocked3
No public exploit3
20008
Not applicable8
High3
Medium5
not blocked8
No public exploit8
20014
Not applicable4
High3
Medium1
not blocked4
No public exploit4
20029
Outside Waratek scope1
Not applicable8
High5
Medium3
Low1
not blocked9
No public exploit9
20033
Not applicable3
Medium3
not blocked3
No public exploit3
20047
Not applicable7
High1
Medium6
not blocked7
No public exploit7
20054
Not applicable4
Medium4
not blocked4
No public exploit4
20066
Not applicable6
High2
Medium4
not blocked6
No public exploit6
20075
Not applicable5
High3
Medium2
not blocked5
No public exploit5
200813
Not applicable13
High10
Medium2
Low1
not blocked13
No public exploit13
20090
20102
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20110
20121
Not applicable1
High1
not blocked1
No public exploit1
20132
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20143
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20150
20163
Not applicable3
High1
Medium2
not blocked3
No public exploit3
201711
Not applicable11
High6
Medium5
not blocked11
No public exploit11
201812
Not applicable12
High8
Medium4
not blocked12
No public exploit12
20197
Not applicable7
High1
Medium6
not blocked7
No public exploit7
20206
Not applicable6
High4
Medium2
not blocked6
No public exploit6
20215
Not applicable5
High5
not blocked5
No public exploit5
20224
Not applicable4
High1
Medium3
not blocked4
No public exploit4
20234
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20248
Not applicable8
High4
Medium4
not blocked8
No public exploit8
20258
Not applicable8
Critical2
High3
Medium3
not blocked8
No public exploit8
202611
Not applicable11
High8
Medium3
not blocked11
No public exploit11
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-80073 | Medium | 2026-09-08 | Not applicable | No public exploit | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-78519 | High | 2026-09-08 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69629 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70329 | High | 2026-08-11 | Not applicable | No public exploit | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-62882 | Medium | 2026-08-11 | Not applicable | No public exploit | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-59868 | Medium | 2026-06-27 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application. |
| CVE-2023-37524 | High | 2026-06-27 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components. |
| CVE-2024-23581 | High | 2026-06-26 | Not applicable | No public exploit | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
| CVE-2026-42893 | High | 2026-05-12 | Not applicable | No public exploit | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network. |
| CVE-2026-26133 | High | 2026-03-16 | Not applicable | No public exploit | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-21260 | High | 2026-02-10 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2024-42192 | Medium | 2025-10-16 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. |
| CVE-2025-49699 | High | 2025-07-08 | Not applicable | No public exploit | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
| CVE-2024-42191 | Critical | 2025-05-30 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. |
| CVE-2024-42190 | Critical | 2025-05-30 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. |
| CVE-2025-29805 | High | 2025-04-08 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-21259 | Medium | 2025-02-11 | Not applicable | No public exploit | Microsoft Outlook Spoofing Vulnerability |
| CVE-2025-21361 | High | 2025-01-14 | Not applicable | No public exploit | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2025-21357 | Medium | 2025-01-14 | Not applicable | No public exploit | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2024-30133 | Medium | 2024-11-12 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways. |
| CVE-2024-43604 | High | 2024-10-08 | Not applicable | No public exploit | Outlook for Android Elevation of Privilege Vulnerability |
| CVE-2024-30134 | High | 2024-09-26 | Not applicable | No public exploit | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
| CVE-2024-43482 | Medium | 2024-09-10 | Not applicable | No public exploit | Microsoft Outlook for iOS Information Disclosure Vulnerability |
| CVE-2024-38173 | Medium | 2024-08-13 | Not applicable | No public exploit | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2024-38020 | Medium | 2024-07-09 | Not applicable | No public exploit | Microsoft Outlook Spoofing Vulnerability |
| CVE-2024-20670 | High | 2024-04-09 | Not applicable | No public exploit | Outlook for Windows Spoofing Vulnerability |
| CVE-2024-26204 | High | 2024-03-12 | Not applicable | No public exploit | Outlook for Android Information Disclosure Vulnerability |
| CVE-2023-36763 | High | 2023-09-12 | Not applicable | No public exploit | Microsoft Outlook Information Disclosure Vulnerability |
| CVE-2023-32119 | Medium | 2023-08-23 | Not applicable | No public exploit | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions. |
| CVE-2023-36893 | Medium | 2023-08-08 | Not applicable | No public exploit | Microsoft Outlook Spoofing Vulnerability |
| CVE-2022-35742 | High | 2023-06-01 | Not applicable | No public exploit | Microsoft Outlook Denial of Service Vulnerability |
| CVE-2022-24480 | Medium | 2022-12-13 | Not applicable | No public exploit | Outlook for Android Elevation of Privilege Vulnerability |
| CVE-2022-22304 | Medium | 2022-07-18 | Not applicable | No public exploit | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. |
| CVE-2022-22782 | High | 2022-04-28 | Not applicable | No public exploit | The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine. |
| CVE-2022-23280 | Medium | 2022-02-09 | Not applicable | No public exploit | Microsoft Outlook for Mac Security Feature Bypass Vulnerability |
| CVE-2021-34413 | High | 2021-09-27 | Not applicable | No public exploit | All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the plugin installation process. This could allow a standard user to write their own malicious application to the plugin directory, allowing the malicious application to execute in a privileged context. |
| CVE-2021-34410 | High | 2021-09-27 | Not applicable | No public exploit | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows for privilege escalation to root. |
| CVE-2021-31949 | High | 2021-06-08 | Not applicable | No public exploit | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2021-31941 | High | 2021-06-08 | Not applicable | No public exploit | Microsoft Office Graphics Remote Code Execution Vulnerability |
| CVE-2021-28452 | High | 2021-04-13 | Not applicable | No public exploit | Microsoft Outlook Memory Corruption Vulnerability |
| CVE-2020-17119 | High | 2020-12-10 | Not applicable | No public exploit | Microsoft Outlook Information Disclosure Vulnerability |
| CVE-2020-16949 | High | 2020-10-16 | Not applicable | No public exploit | <p>A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could cause a remote denial of service against a system.</p> <p>Exploitation of the vulnerability requires that a specially crafted email be sent to a vulnerable Outlook server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Outlook handles objects in memory.</p> |
| CVE-2020-1483 | High | 2020-08-17 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. Note that where severity is indicated as Critical in the Affected Products table, the Preview Pane is an attack vector. The security update addresses the vulnerability by correcting how Outlook handles objects in memory. |
| CVE-2020-0760 | High | 2020-04-15 | Not applicable | No public exploit | A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991. |
| CVE-2020-0696 | Medium | 2020-02-11 | Not applicable | No public exploit | A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'. |
| CVE-2019-1460 | Medium | 2020-01-24 | Not applicable | No public exploit | A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'. |
| CVE-2019-1218 | Medium | 2019-08-14 | Not applicable | No public exploit | A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages. |
| CVE-2019-1204 | Medium | 2019-08-14 | Not applicable | No public exploit | An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email. This update addresses the vulnerability by ensuring Office fully validates incoming email formatting before processing message content. |
| CVE-2019-1200 | High | 2019-08-14 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. Note that the Preview Pane is not an attack vector for this vulnerability. The security update addresses the vulnerability by correcting how Microsoft Outlook handles files in memory. |
| CVE-2019-1105 | Medium | 2019-07-29 | Not applicable | No public exploit | A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages. |
| CVE-2019-1084 | Medium | 2019-07-15 | Not applicable | No public exploit | An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'. |
| CVE-2019-0560 | Medium | 2019-01-08 | Not applicable | No public exploit | An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office. |
| CVE-2019-0559 | Medium | 2019-01-08 | Not applicable | No public exploit | An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. |
| CVE-2018-8582 | High | 2018-11-14 | Not applicable | No public exploit | A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8576. |
| CVE-2018-8576 | High | 2018-11-14 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8582. |
| CVE-2018-8524 | High | 2018-11-14 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8576, CVE-2018-8582. |
| CVE-2018-8522 | High | 2018-11-14 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8524, CVE-2018-8576, CVE-2018-8582. |
| CVE-2018-8244 | Medium | 2018-06-14 | Not applicable | No public exploit | An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook. |
| CVE-2017-17689 | Medium | 2018-05-16 | Not applicable | No public exploit | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
| CVE-2017-17688 | Medium | 2018-05-16 | Not applicable | No public exploit | The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification |
| CVE-2015-7962 | High | 2018-03-02 | Not applicable | No public exploit | SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module. |
| CVE-2018-0852 | High | 2018-02-15 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851. |
| CVE-2018-0851 | High | 2018-02-15 | Not applicable | No public exploit | Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852. |
| CVE-2018-0850 | Medium | 2018-02-15 | Not applicable | No public exploit | Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook Elevation of Privilege Vulnerability". |
| CVE-2018-0791 | High | 2018-01-10 | Not applicable | No public exploit | Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0793. |
| CVE-2017-11776 | High | 2017-10-13 | Not applicable | No public exploit | Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook Information Disclosure Vulnerability." |
| CVE-2017-8663 | High | 2017-08-01 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability" |
| CVE-2017-8572 | Medium | 2017-08-01 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory, aka "Microsoft Office Outlook Information Disclosure Vulnerability". |
| CVE-2017-8571 | High | 2017-08-01 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability". |
| CVE-2017-8545 | Medium | 2017-06-15 | Not applicable | No public exploit | A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability". |
| CVE-2017-8508 | Medium | 2017-06-15 | Not applicable | No public exploit | A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office Security Feature Bypass Vulnerability". |
| CVE-2017-8507 | High | 2017-06-15 | Not applicable | No public exploit | A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email messages, aka "Microsoft Office Memory Corruption Vulnerability". |
| CVE-2017-8506 | High | 2017-06-15 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, and CVE-2017-0260. |
| CVE-2017-0207 | Medium | 2017-04-12 | Not applicable | No public exploit | Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability." |
| CVE-2017-0204 | Medium | 2017-04-12 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Protected View via a specially crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability." |
| CVE-2017-0106 | High | 2017-04-12 | Not applicable | No public exploit | Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2016-3366 | Medium | 2016-09-14 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail attachment, aka "Microsoft Office Spoofing Vulnerability." |
| CVE-2016-3278 | High | 2016-07-13 | Not applicable | No public exploit | Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." |
| CVE-2016-0028 | Medium | 2016-06-16 | Not applicable | No public exploit | Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability." |
| CVE-2014-5359 | High | 2014-12-16 | Not applicable | No public exploit | Directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent (formerly CRYPTOCard) before 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter to owa/owa. |
| CVE-2014-5239 | Medium | 2014-08-14 | Not applicable | No public exploit | The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2014-2510 | Medium | 2014-07-08 | Not applicable | No public exploit | The JAXB XML parser in EMC Documentum Foundation Services (DFS) 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2013-3905 | Medium | 2013-11-13 | Not applicable | No public exploit | Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka "S/MIME AIA Vulnerability." |
| CVE-2013-3870 | High | 2013-09-11 | Not applicable | No public exploit | Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability." |
| CVE-2012-1391 | High | 2012-03-07 | Not applicable | No public exploit | Unspecified vulnerability in the mOffice - Outlook sync (com.innov8tion.isharesync) application 3.1 for Android has unknown impact and attack vectors. |
| CVE-2010-2728 | High | 2010-09-15 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows remote attackers to execute arbitrary code via a crafted e-mail message, aka "Heap Based Buffer Overflow in Outlook Vulnerability." |
| CVE-2010-1568 | Medium | 2010-05-14 | Not applicable | No public exploit | The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623. |
| CVE-2008-5424 | Medium | 2008-12-11 | Not applicable | No public exploit | The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many "Content-type: message/rfc822;" headers, which allows remote attackers to cause a denial of service (infinite loop) via a large e-mail message, a related issue to CVE-2006-1173. |
| CVE-2008-4837 | High | 2008-12-10 | Not applicable | No public exploit | Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Microsoft Works 8 allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed table property, which triggers memory corruption, aka "Word Memory Corruption Vulnerability." |
| CVE-2008-4031 | High | 2008-12-10 | Not applicable | No public exploit | Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a malformed string in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability." |
| CVE-2008-4030 | High | 2008-12-10 | Not applicable | No public exploit | Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 allow remote attackers to execute arbitrary code via crafted control words in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4028. |
| CVE-2008-4028 | High | 2008-12-10 | Not applicable | No public exploit | Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via crafted control words related to multiple Drawing Object tags in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4030. |
| CVE-2008-4027 | High | 2008-12-10 | Not applicable | No public exploit | Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability." |
| CVE-2008-4026 | High | 2008-12-10 | Not applicable | No public exploit | Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed value, which triggers memory corruption, aka "Word Memory Corruption Vulnerability." |
| CVE-2008-4025 | High | 2008-12-10 | Not applicable | No public exploit | Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via (1) an RTF file or (2) a rich text e-mail message containing an invalid number of points for a polyline or polygon, which triggers a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability." |
| CVE-2008-4024 | High | 2008-12-10 | Not applicable | No public exploit | Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an "arbitrary free," aka "Word Memory Corruption Vulnerability." |
| CVE-2008-1448 | High | 2008-08-13 | Not applicable | No public exploit | The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability." |
| CVE-2008-2248 | Medium | 2008-07-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247. |
| CVE-2008-3068 | High | 2008-07-07 | Not applicable | No public exploit | Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension. |
| CVE-2008-2143 | Low | 2008-05-12 | Not applicable | No public exploit | Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information. |