Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

45 records in Publisher · all components

Priority CRITICAL 97KEV

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrat…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.44099 Published 2007-02-03 No fix listed
Priority CRITICAL 91KEV

Microsoft Publisher Security Feature Bypass Vulnerability

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.02667 Published 2024-09-10 Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5465.1001 CWE-693
Priority HIGH 71

Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM fiel…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.49024 Published 2004-09-17 No fix listed
Priority HIGH 69

Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a crafted .pub file, related to invalid "memory values," aka "Publisher Invalid Memor…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.36907 Published 2008-02-12 No fix listed CWE-399
Priority HIGH 65

PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page vi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.32782 Published 2007-07-10 No fix listed CWE-399
Priority MEDIUM 61

Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3, 2003 SP3, 2007 SP2, and 2010 allows remote attackers to execute arbitrary code via a crafted Publisher file tha…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.2467 Published 2010-12-16 No fix listed CWE-119
Priority MEDIUM 60

Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Negative Value Allocation Vul…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.21814 Published 2013-05-15 No fix listed CWE-20
Priority MEDIUM 60

Buffer overflow in Microsoft Office Publisher 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Microsoft Office Publisher File Conversion TextB…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.23415 Published 2010-04-14 No fix listed CWE-119
Priority MEDIUM 60

Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "file format vulnerability." NOTE: this information is based up…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.17901 Published 2007-02-27 No fix listed
Priority MEDIUM 59

Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper memory allocation, aka "Publisher Signed Integer Vulnerabi…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.20766 Published 2013-05-15 No fix listed CWE-189
Priority MEDIUM 59

Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher Integer Overflow Vulne…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.20872 Published 2013-05-15 No fix listed CWE-190
Load more
Open these records in search →