Microsoft Excel Web App vulnerabilities

6 CVEs affecting Microsoft Excel Web App, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-16929, published 2020-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1989, published 2011-09-15. High severity, CVSS 9.3. EPSS: 27.8% chance of exploitation in the next 30 days. Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for…
CVE-2015-1682, published 2015-05-13. High severity, CVSS 9.3. EPSS: 20.4% chance of exploitation in the next 30 days. Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint…
CVE-2017-8631, published 2017-09-13. High severity, CVSS 7.8. EPSS: 17% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Excel Services, Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT…
CVE-2015-6037, published 2015-10-14. Low severity, CVSS 3.5. EPSS: 9.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and…
CVE-2017-0195, published 2017-04-12. Medium severity, CVSS 5.4. EPSS: 3.8% chance of exploitation in the next 30 days. Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office…
CVE-2020-16929, published 2020-10-16. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability…