Microsoft Office Web Apps vulnerabilities

106 CVEs affecting Microsoft Office Web Apps, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-21716, published 2023-02-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability, published 2015-04-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and…
• CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability, published 2014-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 77.7% chance of exploitation in the next 30 days. Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2…
• CVE-2012-2539: Microsoft Word Remote Code Execution Vulnerability, published 2012-12-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 53% chance of exploitation in the next 30 days. Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a…
• CVE-2023-21716, published 2023-02-14. Critical severity, CVSS 9.8. EPSS: 84.8% chance of exploitation in the next 30 days. Microsoft Word Remote Code Execution Vulnerability
• CVE-2016-3357, published 2016-09-14. High severity, CVSS 7.8. EPSS: 54.8% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010…
• CVE-2011-1892, published 2011-09-15. Medium severity, CVSS 4.0. EPSS: 41.4% chance of exploitation in the next 30 days. Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Office Groove…
• CVE-2012-2520, published 2012-10-09. Medium severity, CVSS 4.3. EPSS: 34.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1,…
• CVE-2017-0105, published 2017-03-17. Medium severity, CVSS 5.5. EPSS: 30.4% chance of exploitation in the next 30 days. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow…
• CVE-2013-1330, published 2013-09-11. High severity, CVSS 10.0. EPSS: 30.2% chance of exploitation in the next 30 days. The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute,…
• CVE-2013-3895, published 2013-10-09. Medium severity, CVSS 6.8. EPSS: 29.6% chance of exploitation in the next 30 days. Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability."

Latest

• CVE-2022-22716, published 2022-02-09. Medium severity, CVSS 5.5. EPSS: 4.6% chance of exploitation in the next 30 days. Microsoft Excel Information Disclosure Vulnerability
• CVE-2022-21840, published 2022-01-11. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-43256, published 2021-12-15. High severity, CVSS 7.8. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-38655, published 2021-09-15. High severity, CVSS 7.8. EPSS: 6.4% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-28453, published 2021-04-13. High severity, CVSS 7.8. EPSS: 4.1% chance of exploitation in the next 30 days. Microsoft Word Remote Code Execution Vulnerability
• CVE-2021-27057, published 2021-03-11. High severity, CVSS 7.8. EPSS: 4.3% chance of exploitation in the next 30 days. Microsoft Office Remote Code Execution Vulnerability
• CVE-2021-27054, published 2021-03-11. High severity, CVSS 7.8. EPSS: 4.3% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-27053, published 2021-03-11. High severity, CVSS 7.8. EPSS: 4.6% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability
• CVE-2021-24070, published 2021-02-25. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. Microsoft Excel Remote Code Execution Vulnerability