Office Web Apps vulnerabilities | LiveThreat CVE Feed

Product

Office Web Apps

by Microsoft · last CVE Feb 14, 2023

On CISA KEVExploited in the wild

106

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities106 In the news0 Timeline

Severity mix

Critical 1High 67Medium 14Low 1

Severity

All severities106 Critical1 High67 Medium14 Low1

Exploitation

On CISA KEV3 Exploited in the wild3

Watch

Add Office Web Apps to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2017-8511	7.8	21%	Jun 15	A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2010
CVE-2017-0254	7.8	20%	May 12	Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Office for Mac 2011, Office for Mac 2016, Microsoft Office Web Apps 2010 SP2, Office Web Apps… Affected: 2010; 2013
CVE-2017-0281	7.8	16%	May 12	Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1,… Affected: 2010; 2013
CVE-2017-0030	7.8	26%	Mar 17	Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2… Affected: 2010
CVE-2017-0020	7.8	16%	Mar 17	Microsoft Excel 2016, Excel 2010 SP2, Excel 2013 RT SP1, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: 2013
CVE-2016-7234	7.8	22%	Nov 10	Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word… Affected: 2010; 2013
CVE-2016-7230	7.8	18%	Nov 10	Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft… Affected: 2010
CVE-2016-3360	7.8	17%	Sep 14	Microsoft PowerPoint 2007 SP3, PowerPoint 2010 SP2, PowerPoint 2013 SP1, PowerPoint 2013 RT SP1, PowerPoint 2016 for Mac, Office Compatibility Pack SP3, PowerPoint Viewer,… Affected: 2010
CVE-2016-3357	7.8	55%	Sep 14	Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on… Affected: 2010
CVE-2016-3282	7.8	26%	Jul 13	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word… Affected: 2010
CVE-2016-3281	7.8	20%	Jul 13	Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePoint Server 2010 SP2,… Affected: 2010
CVE-2016-0140	7.8	19%	May 11	Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code… Affected: 2010
CVE-2016-0054	7.8	16%	Feb 10	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel… Affected: 2010
CVE-2017-8696	7.5	14%	Sep 13	Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business… Affected: 2010
CVE-2016-0025	7.3	17%	Jun 16	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack… Affected: 2010
CVE-2016-7291	7.1	23%	Dec 20	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web… Affected: 2010
CVE-2016-7290	7.1	23%	Dec 20	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web… Affected: 2010
CVE-2016-7268	7.1	23%	Dec 20	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and… Affected: 2010
CVE-2016-7233	6.5	22%	Nov 10	Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint… Affected: 2010
CVE-2020-1442	6.1	2%	Jul 14	A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability' Affected: 2013
CVE-2022-22716	5.5	5%	Feb 9	Microsoft Excel Information Disclosure Vulnerability Affected: 2013
CVE-2020-17126	5.5	1%	Dec 10	Microsoft Excel Information Disclosure Vulnerability Affected: 2013
CVE-2020-1224	5.5	4%	Sep 11	<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory Affected: 2013
CVE-2020-1503	5.5	5%	Aug 17	An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory Affected: 2010; 2013
CVE-2020-1445	5.5	6%	Jul 14	An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability' Affected: 2010; 2013
CVE-2020-1342	5.5	6%	Jul 14	An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of… Affected: 2010; 2013
CVE-2018-8378	5.5	7%	Aug 15	An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of… Affected: 2010; 2013
CVE-2017-0105	5.5	30%	Mar 17	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web… Affected: 2010
CVE-2016-3279	5.5	16%	Jul 13	Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word… Affected: 2010
CVE-2016-3234	5.5	26%	Jun 16	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation… Affected: 2010; 2013
CVE-2018-8247	5.4	3%	Jun 14	An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of… Affected: 2013
CVE-2017-0195	5.4	4%	Apr 12	Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server… Affected: 2010
CVE-2018-0919	3.3	12%	Mar 14	Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013… Affected: 2010
CVE-2015-6093	–	23%	Nov 11	Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps… Affected: 2010
CVE-2015-6037	–	10%	Oct 14	Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps… Affected: 2010; 2013
CVE-2015-1650	–	29%	Apr 14	Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word… Affected: 2010; 2013
CVE-2015-1649	–	26%	Apr 14	Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server… Affected: 2010; 2013
CVE-2014-0260	–	18%	Jan 15	Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps… Affected: 2010; 2010
CVE-2013-5059	–	15%	Dec 11	Microsoft SharePoint Server 2010 SP1 and SP2 and 2013, and Office Web Apps 2013, allows remote attackers to execute arbitrary code via crafted page content, aka "SharePoint Page… Affected: 2013
CVE-2013-3895	–	30%	Oct 9	Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability." Affected: 2010
CVE-2013-3889	–	27%	Oct 9	Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack… Affected: 2010; 2010
CVE-2013-3858	–	21%	Sep 11	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility… Affected: 2010
CVE-2013-3857	–	21%	Sep 11	Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and… Affected: 2010; 2010
CVE-2013-3849	–	21%	Sep 11	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility… Affected: 2010
CVE-2013-3848	–	21%	Sep 11	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility… Affected: 2010
CVE-2013-3847	–	21%	Sep 11	Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility… Affected: 2010
CVE-2013-1330	–	30%	Sep 11	The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the… Affected: 2010
CVE-2013-1315	–	29%	Sep 11	Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel… Affected: 2010
CVE-2013-1289	–	15%	Apr 9	Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows… Affected: 2010
CVE-2012-2528	–	22%	Oct 9	Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft… Affected: 2010