WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor microsoft✕Product outlook✕
Overview 176 matches · 0 in Waratek scope · 0 protected · 8 exploited · 6 CISA KEV · 37 public PoC · 10 EPSS ≥ 0.5
176matches 0in Waratek scope0.0% 0protected0.0% 8exploited4.5% 6CISA KEV3.4% 37public PoC21.0% 10EPSS ≥ 0.55.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 0.6% Not applicable 175 99.4% Withdrawn CVE 0 0.0%
Critical 2 1.1% High 91 51.7% Medium 81 46.0% Low 2 1.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 176 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 8 4.5% Working exploit published 29 16.5% Proof of concept only 6 3.4% Forecast only 1 0.6% No public exploit 132 75.0%
split by peak 14 / year
Not applicable: 175Outside Waratek scope: 1 Low: 2Medium: 81High: 91Critical: 2 not blocked: 176 No public exploit: 132Forecast only: 1Proof of concept only: 6Working exploit published: 29Exploited: 8
19972 Not applicable2 High2 not blocked2 No public exploit2 19980 19996 Not applicable6 Medium6 not blocked6 Working exploit published3 No public exploit3 200011 Not applicable11 High3 Medium8 not blocked11 Working exploit published3 No public exploit8 20018 Not applicable8 High6 Medium2 not blocked8 Working exploit published4 No public exploit4 200211 Not applicable11 High5 Medium5 Low1 not blocked11 Working exploit published3 No public exploit8 20034 Not applicable4 High1 Medium3 not blocked4 Working exploit published1 No public exploit3 200414 Outside Waratek scope1 Not applicable13 High5 Medium9 not blocked14 Exploited1 Working exploit published6 No public exploit7 20055 Not applicable5 High1 Medium4 not blocked5 Working exploit published1 No public exploit4 20069 Not applicable9 High3 Medium6 not blocked9 Exploited1 Working exploit published2 No public exploit6 20077 Not applicable7 High5 Medium2 not blocked7 Exploited1 Forecast only1 No public exploit5 200813 Not applicable13 High10 Medium2 Low1 not blocked13 No public exploit13 20090 20105 Not applicable5 High4 Medium1 not blocked5 Working exploit published4 No public exploit1 20110 20120 20132 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20141 Not applicable1 Medium1 not blocked1 No public exploit1 20151 Not applicable1 High1 not blocked1 Exploited1 20163 Not applicable3 High1 Medium2 not blocked3 No public exploit3 201712 Not applicable12 High7 Medium5 not blocked12 Exploited1 No public exploit11 201811 Not applicable11 High7 Medium4 not blocked11 No public exploit11 20197 Not applicable7 High1 Medium6 not blocked7 No public exploit7 20209 Not applicable9 High6 Medium3 not blocked9 Proof of concept only3 No public exploit6 20213 Not applicable3 High3 not blocked3 No public exploit3 20222 Not applicable2 Medium2 not blocked2 No public exploit2 20236 Not applicable6 Critical1 High4 Medium1 not blocked6 Exploited2 Working exploit published1 No public exploit3 20249 Not applicable9 Critical1 High5 Medium3 not blocked9 Proof of concept only3 No public exploit6 20256 Not applicable6 High3 Medium3 not blocked6 Working exploit published1 No public exploit5 20269 Not applicable9 High7 Medium2 not blocked9 Exploited1 No public exploit8
1999200220052008201120142017202020232026
176 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-96951 High 2026-10-13 Not applicable Exploited Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-80073 Medium 2026-09-08 Not applicable No public exploit Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
CVE-2026-78519 High 2026-09-08 Not applicable No public exploit Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-69629 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-70329 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-62882 Medium 2026-08-11 Not applicable No public exploit Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-42893 High 2026-05-12 Not applicable No public exploit Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
CVE-2026-26133 High 2026-03-16 Not applicable No public exploit AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-21260 High 2026-02-10 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49699 High 2025-07-08 Not applicable No public exploit Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-47171 Medium 2025-06-10 Not applicable Working exploit published Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-29805 High 2025-04-08 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
CVE-2025-21259 Medium 2025-02-11 Not applicable No public exploit Microsoft Outlook Spoofing Vulnerability
CVE-2025-21361 High 2025-01-14 Not applicable No public exploit Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-21357 Medium 2025-01-14 Not applicable No public exploit Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-42220 Critical 2024-12-18 Not applicable Proof of concept only A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.
CVE-2024-43604 High 2024-10-08 Not applicable No public exploit Outlook for Android Elevation of Privilege Vulnerability
CVE-2024-43482 Medium 2024-09-10 Not applicable No public exploit Microsoft Outlook for iOS Information Disclosure Vulnerability
CVE-2024-38173 Medium 2024-08-13 Not applicable No public exploit Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38020 Medium 2024-07-09 Not applicable No public exploit Microsoft Outlook Spoofing Vulnerability
CVE-2024-30103 High 2024-06-11 Not applicable Proof of concept only Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-20670 High 2024-04-09 Not applicable No public exploit Outlook for Windows Spoofing Vulnerability
CVE-2024-26204 High 2024-03-12 Not applicable No public exploit Outlook for Android Information Disclosure Vulnerability
CVE-2024-21378 High 2024-02-13 Not applicable Proof of concept only Microsoft Outlook Remote Code Execution Vulnerability
CVE-2023-36763 High 2023-09-12 Not applicable No public exploit Microsoft Outlook Information Disclosure Vulnerability
CVE-2023-36893 Medium 2023-08-08 Not applicable No public exploit Microsoft Outlook Spoofing Vulnerability
CVE-2023-35311 High 2023-07-11 Not applicable Exploited Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-33131 High 2023-06-14 Not applicable Working exploit published Microsoft Outlook Remote Code Execution Vulnerability
CVE-2022-35742 High 2023-06-01 Not applicable No public exploit Microsoft Outlook Denial of Service Vulnerability
CVE-2023-23397 Critical 2023-03-14 Not applicable Exploited Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2022-24480 Medium 2022-12-13 Not applicable No public exploit Outlook for Android Elevation of Privilege Vulnerability
CVE-2022-23280 Medium 2022-02-09 Not applicable No public exploit Microsoft Outlook for Mac Security Feature Bypass Vulnerability
CVE-2021-31949 High 2021-06-08 Not applicable No public exploit Microsoft Outlook Remote Code Execution Vulnerability
CVE-2021-31941 High 2021-06-08 Not applicable No public exploit Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-28452 High 2021-04-13 Not applicable No public exploit Microsoft Outlook Memory Corruption Vulnerability
CVE-2020-17119 High 2020-12-10 Not applicable No public exploit Microsoft Outlook Information Disclosure Vulnerability
CVE-2020-16949 High 2020-10-16 Not applicable No public exploit <p>A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could cause a remote denial of service against a system.</p> <p>Exploitation of the vulnerability requires that a specially crafted email be sent to a vulnerable Outlook server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Outlook handles objects in memory.</p>
CVE-2020-16947 High 2020-10-16 Not applicable Proof of concept only <p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the targeted user. If the targeted user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p> <p>Note that where severity is indicated as Critical in the Affected Products table, the Preview Pane is an attack vector.</p> <p>The security update addresses the vulnerability by correcting how Outlook handles objects in memory.</p>
CVE-2020-1493 Medium 2020-08-17 Not applicable Proof of concept only An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.
CVE-2020-1483 High 2020-08-17 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. Note that where severity is indicated as Critical in the Affected Products table, the Preview Pane is an attack vector. The security update addresses the vulnerability by correcting how Outlook handles objects in memory.
CVE-2020-1349 High 2020-07-14 Not applicable Proof of concept only A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'.
CVE-2020-0760 High 2020-04-15 Not applicable No public exploit A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991.
CVE-2020-0696 Medium 2020-02-11 Not applicable No public exploit A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'.
CVE-2019-1460 Medium 2020-01-24 Not applicable No public exploit A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
CVE-2019-1218 Medium 2019-08-14 Not applicable No public exploit A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages.
CVE-2019-1204 Medium 2019-08-14 Not applicable No public exploit An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email. This update addresses the vulnerability by ensuring Office fully validates incoming email formatting before processing message content.
CVE-2019-1200 High 2019-08-14 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user. To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. Note that the Preview Pane is not an attack vector for this vulnerability. The security update addresses the vulnerability by correcting how Microsoft Outlook handles files in memory.
CVE-2019-1105 Medium 2019-07-29 Not applicable No public exploit A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.
CVE-2019-1084 Medium 2019-07-15 Not applicable No public exploit An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
CVE-2019-0560 Medium 2019-01-08 Not applicable No public exploit An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office.
CVE-2019-0559 Medium 2019-01-08 Not applicable No public exploit An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.
CVE-2018-8582 High 2018-11-14 Not applicable No public exploit A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8576.
CVE-2018-8576 High 2018-11-14 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8524, CVE-2018-8582.
CVE-2018-8524 High 2018-11-14 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8522, CVE-2018-8576, CVE-2018-8582.
CVE-2018-8522 High 2018-11-14 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook. This CVE ID is unique from CVE-2018-8524, CVE-2018-8576, CVE-2018-8582.
CVE-2018-8244 Medium 2018-06-14 Not applicable No public exploit An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.
CVE-2017-17689 Medium 2018-05-16 Not applicable No public exploit The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2017-17688 Medium 2018-05-16 Not applicable No public exploit The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
CVE-2018-0852 High 2018-02-15 Not applicable No public exploit Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851.
CVE-2018-0851 High 2018-02-15 Not applicable No public exploit Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
CVE-2018-0850 Medium 2018-02-15 Not applicable No public exploit Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook Elevation of Privilege Vulnerability".
CVE-2018-0791 High 2018-01-10 Not applicable No public exploit Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are parsed, aka "Microsoft Outlook Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0793.
CVE-2017-11776 High 2017-10-13 Not applicable No public exploit Microsoft Outlook 2016 allows an attacker to obtain the email content of a user, due to how Outlook 2016 discloses user email content, aka "Microsoft Outlook Information Disclosure Vulnerability."
CVE-2017-11774 High 2017-10-13 Not applicable Exploited Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
CVE-2017-8663 High 2017-08-01 Not applicable No public exploit Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability"
CVE-2017-8572 Medium 2017-08-01 Not applicable No public exploit Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory, aka "Microsoft Office Outlook Information Disclosure Vulnerability".
CVE-2017-8571 High 2017-08-01 Not applicable No public exploit Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability".
CVE-2017-8545 Medium 2017-06-15 Not applicable No public exploit A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVE-2017-8508 Medium 2017-06-15 Not applicable No public exploit A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office Security Feature Bypass Vulnerability".
CVE-2017-8507 High 2017-06-15 Not applicable No public exploit A remote code execution vulnerability exists in the way Microsoft Office software parses specially crafted email messages, aka "Microsoft Office Memory Corruption Vulnerability".
CVE-2017-8506 High 2017-06-15 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, and CVE-2017-0260.
CVE-2017-0207 Medium 2017-04-12 Not applicable No public exploit Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."
CVE-2017-0204 Medium 2017-04-12 Not applicable No public exploit Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Protected View via a specially crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability."
CVE-2017-0106 High 2017-04-12 Not applicable No public exploit Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2016-3366 Medium 2016-09-14 Not applicable No public exploit Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail attachment, aka "Microsoft Office Spoofing Vulnerability."
CVE-2016-3278 High 2016-07-13 Not applicable No public exploit Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2016-0028 Medium 2016-06-16 Not applicable No public exploit Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."
CVE-2015-1641 High 2015-04-14 Not applicable Exploited Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2014-5239 Medium 2014-08-14 Not applicable No public exploit The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2013-3905 Medium 2013-11-13 Not applicable No public exploit Microsoft Outlook 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT does not properly expand metadata contained in S/MIME certificates, which allows remote attackers to obtain sensitive network configuration and state information via a crafted certificate in an e-mail message, aka "S/MIME AIA Vulnerability."
CVE-2013-3870 High 2013-09-11 Not applicable No public exploit Double free vulnerability in Microsoft Outlook 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to execute arbitrary code by including many nested S/MIME certificates in an e-mail message, aka "Message Certificate Vulnerability."
CVE-2010-2728 High 2010-09-15 Not applicable No public exploit Heap-based buffer overflow in Microsoft Outlook 2002 SP3, 2003 SP3, and 2007 SP2, when Online Mode for an Exchange Server is enabled, allows remote attackers to execute arbitrary code via a crafted e-mail message, aka "Heap Based Buffer Overflow in Outlook Vulnerability."
CVE-2010-3213 Medium 2010-09-07 Not applicable Working exploit published Cross-site request forgery (CSRF) vulnerability in Microsoft Outlook Web Access (owa/ev.owa) 2007 through SP2 allows remote attackers to hijack the authentication of e-mail users for requests that perform Outlook requests, as demonstrated by setting the auto-forward rule.
CVE-2010-3147 High 2010-08-27 Not applicable Working exploit published Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a Trojan horse wab32res.dll file in the current working directory, as demonstrated by a directory that contains a Windows Address Book (WAB), VCF (aka vCard), or P7C file, aka "Insecure Library Loading Vulnerability." NOTE: the codebase for this product may overlap the codebase for the product referenced in CVE-2010-3143.
CVE-2010-0266 High 2010-07-15 Not applicable Working exploit published Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability."
CVE-2010-0816 High 2010-05-12 Not applicable Working exploit published Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7; and Windows Mail on Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows remote e-mail servers and man-in-the-middle attackers to execute arbitrary code via a crafted (1) POP3 or (2) IMAP response, as demonstrated by a certain +OK response on TCP port 110, aka "Outlook Express and Windows Mail Integer Overflow Vulnerability."
CVE-2008-5424 Medium 2008-12-11 Not applicable No public exploit The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many "Content-type: message/rfc822;" headers, which allows remote attackers to cause a denial of service (infinite loop) via a large e-mail message, a related issue to CVE-2006-1173.
CVE-2008-4837 High 2008-12-10 Not applicable No public exploit Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Microsoft Works 8 allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed table property, which triggers memory corruption, aka "Word Memory Corruption Vulnerability."
CVE-2008-4031 High 2008-12-10 Not applicable No public exploit Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a malformed string in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability."
CVE-2008-4030 High 2008-12-10 Not applicable No public exploit Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 allow remote attackers to execute arbitrary code via crafted control words in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4028.
CVE-2008-4028 High 2008-12-10 Not applicable No public exploit Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via crafted control words related to multiple Drawing Object tags in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4030.
CVE-2008-4027 High 2008-12-10 Not applicable No public exploit Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability."
CVE-2008-4026 High 2008-12-10 Not applicable No public exploit Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed value, which triggers memory corruption, aka "Word Memory Corruption Vulnerability."
CVE-2008-4025 High 2008-12-10 Not applicable No public exploit Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via (1) an RTF file or (2) a rich text e-mail message containing an invalid number of points for a polyline or polygon, which triggers a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability."
CVE-2008-4024 High 2008-12-10 Not applicable No public exploit Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an "arbitrary free," aka "Word Memory Corruption Vulnerability."
CVE-2008-1448 High 2008-08-13 Not applicable No public exploit The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames, which allows remote attackers to bypass intended access restrictions and read arbitrary files via an mhtml: URI in conjunction with a redirection, aka "URL Parsing Cross-Domain Information Disclosure Vulnerability."
CVE-2008-2248 Medium 2008-07-08 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.
CVE-2008-3068 High 2008-07-07 Not applicable No public exploit Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
CVE-2008-2143 Low 2008-05-12 Not applicable No public exploit Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information.
CVE-2007-3897 High 2007-10-09 Not applicable Forecast only Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.
‹ prev page 1 of 2 next ›