Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 28 of 58
May 11, 2023A vulnerability was found in Weaver E-Office 9.5 and classified as critical.CVE-2023-2647 · Other software · Weaver · reported by VulDBMedium 6.3
A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Microsoft Word Security Feature Bypass VulnerabilityCVE-2023-29335 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Word Security Feature Bypass Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 9, 2023Microsoft Access Denial of Service VulnerabilityCVE-2023-29333 · Email & office · Microsoft · reported by secure@microsoft.comLow 3.3
Microsoft Access Denial of Service Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 9, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-24953 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 4, 2023A vulnerability was found in Weaver E-Office 9.5.CVE-2023-2523 · Other software · Weaver · reported by VulDBHigh 7.3
A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information CVE-2023-25292 · Other software · Group-office · reported by MITREMedium 6.1
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
- Product
- Group Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Microsoft Word Remote Code Execution VulnerabilityCVE-2023-28311 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Word Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-28285 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.compacketstormsecurity.com
Mar 31, 2023Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online.CVE-2023-28645 · Other software · nextcloud · reported by GitHubMedium 5.7
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.nextcloud.comgithub.com
Mar 30, 2023AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrCVE-2023-28731 · Other software · AcyMailing · reported by vulnerability@ncsc.chCritical 9.8
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla in the Enterprise version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacymailing.combugbounty.ch
Mar 27, 2023amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.CVE-2023-23330 · Other software · Amano · reported by MITREHigh 7.5
amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.
- Product
- Xoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments.CVE-2022-47502 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 24, 2023Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path.CVE-2022-38745 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
- Product
- Apache OpenOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenoffice.org
Mar 18, 2023ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directoCVE-2022-48422 · Other software · Onlyoffice · reported by MITREHigh 7.8
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.onlyoffice.comforum.onlyoffice.com
Mar 14, 2023Microsoft Excel Remote Code Execution VulnerabilityCVE-2023-23399 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Excel Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft Excel Spoofing VulnerabilityCVE-2023-23398 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Excel Spoofing Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft Office Outlook Privilege Escalation VulnerabilityCVE-2023-23397 · Email & office · Microsoft · reported by secure@microsoft.comExploitedCritical 9.8
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
- Product
- Office
- On CISA’s list since
- Mar 14, 2023 (federal fix deadline Apr 4, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft Excel Denial of Service VulnerabilityCVE-2023-23396 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Excel Denial of Service Vulnerability
- Product
- Microsoft Office Online Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Office for Android Spoofing VulnerabilityCVE-2023-23391 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Office for Android Spoofing Vulnerability
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 28, 2023An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.CVE-2022-47076 · Other software · Smartofficepayroll · reported by MITREHigh 7.5
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.
- Product
- Smartoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcvewalkthrough.com
Feb 28, 2023An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeCVE-2022-47075 · Other software · Smartofficepayroll · reported by MITREHigh 7.5
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
- Product
- Smartoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcvewalkthrough.com
Feb 14, 2023Microsoft Office Publisher Security Feature Bypass VulnerabilityCVE-2023-21715 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.3
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
- Product
- Office
- On CISA’s list since
- Feb 14, 2023 (federal fix deadline Mar 7, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft Office Information Disclosure VulnerabilityCVE-2023-21714 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Office Information Disclosure Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 13, 2023Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the saCVE-2023-25159 · Other software · nextcloud · reported by GitHubLow 2.3
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get applied. This issue is fixed in Nextcloud Server 25.0.1 and 24.0.8, Nextcloud Enterprise Server 25.0.1 and 24.0.8, and Nextcloud Office (Richdocuments) App 7.0.1 (for 25) and 6.3.1 (for 24). No known workarounds are available.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Local privilege escalation due to incomplete uninstallation cleanup.CVE-2022-45455 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 8, 2023Nextcloud office/richdocuments is an office suit for the nextcloud server platform.CVE-2023-25150 · Other software · nextcloud · reported by GitHubMedium 5.8
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS)CVE-2022-47412 · Other software · ONLYOFFICE · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
- Product
- Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.CVE-2023-23331 · Other software · Amano · reported by MITRECritical 9.8
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
- Product
- Xoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xhunter20.medium.comamano.eu
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2021-43449 · Other software · Onlyoffice · reported by MITREHigh 8.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation.CVE-2021-43448 · Other software · Onlyoffice · reported by MITREMedium 5.3
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43447 · Other software · Onlyoffice · reported by MITREHigh 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS).CVE-2021-43446 · Other software · Onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43445 · Other software · Onlyoffice · reported by MITRECritical 9.8
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43444 · Other software · Onlyoffice · reported by MITREHigh 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 10, 2023Microsoft Office Visio Information Disclosure VulnerabilityCVE-2023-21741 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Office Visio Information Disclosure Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-21738 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-21737 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-21736 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-21735 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Microsoft Office Remote Code Execution VulnerabilityCVE-2023-21734 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 5, 2023A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series.CVE-2022-37934 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.8
A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allow remote directory traversal in HPE OfficeConnect 1820 switch series version PT.02.17 and below, HPE OfficeConnect 1850 switch series version PC.01.23 and below, and HPE OfficeConnect 1850 (10G aggregator) switch version PO.01.22 and below.
- Product
- HPE OfficeConnect 1820 and 1850 Switch Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Dec 13, 2022Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2022-47213 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2022-47212 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2022-47211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Outlook for Mac Spoofing VulnerabilityCVE-2022-44713 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Outlook for Mac Spoofing Vulnerability
- Product
- Microsoft Office LTSC for Mac 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-44696 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-44695 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-44694 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Visio Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office Graphics Remote Code Execution VulnerabilityCVE-2022-44692 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability
- Product
- Microsoft Office 2019 for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Office OneNote Remote Code Execution VulnerabilityCVE-2022-44691 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Office OneNote Remote Code Execution Vulnerability
- Product
- Microsoft Office LTSC 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.