Microsoft Expression Web vulnerabilities

9 CVEs affecting Microsoft Expression Web, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-0007, published 2013-01-09.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-0007, published 2013-01-09. High severity, CVSS 9.3. EPSS: 31.6% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT…
• CVE-2013-0006, published 2013-01-09. High severity, CVSS 8.8. EPSS: 28.1% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer…
• CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
• CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
• CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
• CVE-2009-2503, published 2009-10-14. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio…
• CVE-2009-2502, published 2009-10-14. High severity, CVSS 8.1. EPSS: 22% chance of exploitation in the next 30 days. Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
• CVE-2009-2504, published 2009-10-14. High severity, CVSS 9.3. EPSS: 21% chance of exploitation in the next 30 days. Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server…
• CVE-2009-2528, published 2009-10-14. High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days. GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that…