High

DATE	CVE	VULNERABILITY TITLE	RISK
2020-05-21	CVE-2020-0901	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Microsoft 365 Apps and Office A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. network low complexity microsoft CWE-119	7.5
2019-12-10	CVE-2019-1461	Unspecified vulnerability in Microsoft Office, Office 365 Proplus and Word A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of Service Vulnerability'. network microsoft	7.1
2019-06-12	CVE-2019-1035	Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. local low complexity microsoft	7.8
2018-08-15	CVE-2018-8375	Unspecified vulnerability in Microsoft products A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel. local low complexity microsoft	7.8
2017-03-17	CVE-2017-0014	Remote Code Execution vulnerability in Microsoft Windows Graphics Component The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component Remote Code Execution Vulnerability." This vulnerability is different from that described in CVE-2017-0108. network high complexity microsoft	7.6
2016-12-20	CVE-2016-7275	Permissions, Privileges, and Access Controls vulnerability in Microsoft Office 2010/2013/2016 Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability." local low complexity microsoft CWE-264	7.2
2016-03-09	CVE-2016-0057	Permissions, Privileges, and Access Controls vulnerability in Microsoft Office Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka "Microsoft Office Security Feature Bypass Vulnerability." local low complexity microsoft CWE-264	7.2
2010-03-10	CVE-2010-0258	Type Confusion vulnerability in Microsoft products Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability." local low complexity microsoft CWE-843	7.8
2008-07-07	CVE-2008-3068	Remote Information Disclosure vulnerability in Microsoft Crypto API X.509 Certificate Validation Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension. network low complexity microsoft	7.5
2007-06-19	CVE-2007-3282	Denial-Of-Service vulnerability in Office Msodatasourcecontrol Activex Buffer overflow in the Microsoft Office MSODataSourceControl ActiveX object allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the DeleteRecordSourceIfUnused method. network low complexity microsoft	7.8