Microsoft Office vulnerabilities

CVE-2002-0615 [HIGH] CVE-2002-0615: The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well The Windows Media Active Playlist in Microsoft Windows Media Player 7.1 stores information in a well known location on the local file system, allowing attackers to execute HTML scripts in the Local Computer zone, aka "Media Playback Script Invocation".

CVE-2002-0616 [MEDIUM] CVE-2002-0616: The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to exe The Macro Security Model in Microsoft Excel 2000 and 2002 for Windows allows remote attackers to execute code by attaching an inline macro to an object within an Excel workbook, aka the "Excel Inline Macros Vulnerability."

CVE-2023-36766 [MEDIUM] CWE-125 CVE-2023-36766: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2023-36009 [MEDIUM] CVE-2023-36009: Microsoft Word Information Disclosure Vulnerability Microsoft Word Information Disclosure Vulnerability

CVE-2020-17126 [MEDIUM] CVE-2020-17126: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2025-21383 [MEDIUM] CWE-125 CVE-2025-21383: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2022-23252 [MEDIUM] CVE-2022-23252: Microsoft Office Information Disclosure Vulnerability Microsoft Office Information Disclosure Vulnerability

CVE-2021-40472 [MEDIUM] CVE-2021-40472: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2000-0088 [HIGH] CVE-2000-0088: Buffer overflow in the conversion utilities for Japanese, Korean and Chinese Word 5 documents allows Buffer overflow in the conversion utilities for Japanese, Korean and Chinese Word 5 documents allows an attacker to execute commands, aka the "Malformed Conversion Data" vulnerability.

CVE-2017-8676 [LOW] CWE-200 CVE-2017-8676: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2

CVE-2022-41103 [MEDIUM] CVE-2022-41103: Microsoft Word Information Disclosure Vulnerability Microsoft Word Information Disclosure Vulnerability

CVE-2023-33162 [MEDIUM] CWE-125 CVE-2023-33162: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2021-40454 [MEDIUM] CWE-312 CVE-2021-40454: Rich Text Edit Control Information Disclosure Vulnerability Rich Text Edit Control Information Disclosure Vulnerability

CVE-2022-41060 [MEDIUM] CVE-2022-41060: Microsoft Word Information Disclosure Vulnerability Microsoft Word Information Disclosure Vulnerability

CVE-2022-41105 [MEDIUM] CVE-2022-41105: Microsoft Excel Information Disclosure Vulnerability Microsoft Excel Information Disclosure Vulnerability

CVE-2022-33632 [MEDIUM] CVE-2022-33632: Microsoft Office Security Feature Bypass Vulnerability Microsoft Office Security Feature Bypass Vulnerability

CVE-2018-0919 [LOW] CWE-125 CVE-2018-0919: Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2 Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2010 SP2, Word 2013 SP1

CVE-2002-0021 [MEDIUM] CVE-2002-0021: Network Product Identification (PID) Checker in Microsoft Office v. X for Mac allows remote attacker Network Product Identification (PID) Checker in Microsoft Office v. X for Mac allows remote attackers to cause a denial of service (crash) via a malformed product announcement.

CVE-2018-0853 [LOW] CWE-665 CVE-2018-0853: Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsof Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability, due to how Office initializes the affected variable, aka "Microsoft Office Information Disclosure Vulnerability".

CVE-2008-7217 [MEDIUM] CWE-264 CVE-2008-7217: Microsoft Office 2008 for Mac, when running on Macintosh systems that restrict Office access to admi Microsoft Office 2008 for Mac, when running on Macintosh systems that restrict Office access to administrators, does not enforce this restriction for user ID 502, which allows local users with that ID to bypass intended security policy and access Office programs, related to permissions and ownership for certain directories.