Microsoft Office Web Components vulnerabilities

13 CVEs affecting Microsoft Office Web Components, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1856, published 2012-08-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office…
CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-08-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 72% chance of exploitation in the next 30 days. The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL…
CVE-2009-1136, published 2009-07-15. High severity, CVSS 9.3. EPSS: 62% chance of exploitation in the next 30 days. The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components…
CVE-2009-1534, published 2009-08-12. High severity, CVSS 9.3. EPSS: 51.6% chance of exploitation in the next 30 days. Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003…
CVE-2006-4695, published 2006-12-31. High severity, CVSS 9.3. EPSS: 40.1% chance of exploitation in the next 30 days. Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL, aka "Office Web Components…
CVE-2009-2496, published 2009-08-12. High severity, CVSS 9.3. EPSS: 29.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web…
CVE-2009-0562, published 2009-08-12. High severity, CVSS 9.3. EPSS: 25.7% chance of exploitation in the next 30 days. The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007…
CVE-2002-1338, published 2002-12-18. Medium severity, CVSS 5.0. EPSS: 23.4% chance of exploitation in the next 30 days. The Load method in the Chart component of Office Web Components (OWC) 9 and 10 generates an exception when a specified file does not exist, which allows remote attackers to determine the existence of…
CVE-2002-0727, published 2002-09-24. High severity, CVSS 7.5. EPSS: 18.8% chance of exploitation in the next 30 days. The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute arbitrary commands…
CVE-2002-0860, published 2002-09-24. Medium severity, CVSS 5.0. EPSS: 18.8% chance of exploitation in the next 30 days. The LoadText method in the spreadsheet component in Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to read arbitrary files through Internet Explorer via a URL that…

Latest

CVE-2002-1340, published 2002-12-18. Medium severity, CVSS 5.0. EPSS: 12% chance of exploitation in the next 30 days. The "ConnectionFile" property in the DataSourceControl component in Office Web Components (OWC) 10 allows remote attackers to determine the existence of local files by detecting an exception.
CVE-2002-1339, published 2002-12-18. Medium severity, CVSS 5.0. EPSS: 12% chance of exploitation in the next 30 days. The "XMLURL" property in the Spreadsheet component of Office Web Components (OWC) 10 follows redirections, which allows remote attackers to determine the existence of local files based on exceptions,…