Microsoft Host Integration Server vulnerabilities

4 CVEs affecting Microsoft Host Integration Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-38151, published 2023-11-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-08-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 72% chance of exploitation in the next 30 days. The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL…
CVE-2011-2007, published 2011-10-12. Medium severity, CVSS 5.0. EPSS: 23% chance of exploitation in the next 30 days. Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka…
CVE-2011-2008, published 2011-10-12. Medium severity, CVSS 5.0. EPSS: 21.3% chance of exploitation in the next 30 days. Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Access…
CVE-2023-38151, published 2023-11-14. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability