365 Apps vulnerabilities
18 known vulnerabilities in 365 Apps from Microsoft. 16 are rated high or critical, and 11 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 6.5 Medium severity
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Exploited
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft 365 Apps for Enterprise: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
- 7.8 High severity
Microsoft 365 Apps for Enterprise: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Microsoft 365 Apps for Enterprise: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- 7.8 High severity
Microsoft 365 Apps for Enterprise: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.
- 7.0 High severity
Microsoft 365 Apps for Enterprise: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- 7.8 High severity
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Exploited
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
- 7.5 High severity
Microsoft 365 Apps for Enterprise: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 7.8 High severity
Microsoft Office Security Feature Bypass Exploited
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
- 8.8 High severity
Microsoft Project Remote Code Execution Exploited
Microsoft Project Remote Code Execution Vulnerability
- 9.8 Critical severity
Microsoft Outlook Improper Input Validation Exploited
Microsoft Outlook Remote Code Execution Vulnerability
- 7.8 High severity
3D Viewer: Heap-based Buffer Overflow
A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feat
- 6.5 Medium severity
Microsoft Word Information Disclosure Exploited
Microsoft Word Information Disclosure Vulnerability
- 7.5 High severity
Microsoft Outlook Security Feature Bypass Exploited
Microsoft Outlook Security Feature Bypass Vulnerability
- 9.8 Critical severity
Microsoft Office Outlook Privilege Escalation Exploited
Microsoft Outlook Elevation of Privilege Vulnerability
- 7.3 High severity
Microsoft Office Publisher Security Feature Bypass Exploited
Microsoft Publisher Security Feature Bypass Vulnerability
- 7.8 High severity
Microsoft Excel Security Feature Bypass Exploited
Microsoft Excel Security Feature Bypass Vulnerability
- 7.8 High severity
Microsoft Office Access Connectivity Engine Remote Code Execution Exploited
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability