Medium
CVE-2022-28715
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Tag: Microsoft Office
All CVEs associated with "Microsoft Office". Page 6/16 • 1815 CVEs.
Subscribe CVEs: RSS for “Microsoft Office” · RSS (High+Critical only)
About “Microsoft Office”
A curated feed of “Microsoft Office”-related CVEs appears below. We currently track 1815 CVEs for this tag (all time). In the last 365 days, 254 were published. Average CVSS is 7.5 (all time; 7.5 over 365d), and 68% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-416 - Use After Free, CWE-122 - Heap-based Buffer Overflow, CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
In our taxonomy this topic maps to a LOW impact class. Vendor advisories and release notes are key. Verify compatibility matrices, prefer supported long term versions, and stage rollouts with monitoring. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2022-08-18
Medium
CVE-2022-25986
Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler.
2022-08-16
Critical
CVE-2022-36344
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the aff…
2022-08-09
High
CVE-2022-34717
Microsoft Office Remote Code Execution Vulnerability
2022-08-02
High
CVE-2022-34924
Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/varkind/custom.jsp.
2022-07-25
High
CVE-2022-29709
CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters.
2022-07-12
Medium
CVE-2022-33632
Microsoft Office Security Feature Bypass Vulnerability
2022-06-15
High
CVE-2022-30174
Microsoft Office Remote Code Execution Vulnerability
Medium
CVE-2022-30172
Microsoft Office Information Disclosure Vulnerability
Medium
CVE-2022-30171
Microsoft Office Information Disclosure Vulnerability
Medium
CVE-2022-30159
Microsoft Office Information Disclosure Vulnerability
2022-06-02
Medium
CVE-2022-31024
richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Of…
2022-05-12
High
CVE-2021-40399
An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting…
2022-05-10
Medium
CVE-2022-29107
Microsoft Office Security Feature Bypass Vulnerability
2022-04-07
High
CVE-2021-43430
An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.
2022-03-23
Critical
CVE-2022-24934
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
2022-03-17
High
CVE-2022-26081
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
High
CVE-2022-25969
The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
2022-03-09
Medium
CVE-2022-24511
Microsoft Office Word Tampering Vulnerability
High
CVE-2022-24510
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2022-24509
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2022-24461
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2022-25943
The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.
2022-02-16
High
CVE-2021-21958
A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and poten…
2022-02-09
Medium
CVE-2022-23252
Microsoft Office Information Disclosure Vulnerability
High
CVE-2022-22004
Microsoft Office ClickToRun Remote Code Execution Vulnerability
High
CVE-2022-22003
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2022-21988
Microsoft Office Visio Remote Code Execution Vulnerability
2022-02-08
Medium
CVE-2021-20877
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w…
2022-02-04
High
CVE-2022-24115
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 202…
High
CVE-2022-24114
Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (ma…
High
CVE-2022-24113
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows…
High
CVE-2021-44206
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Ac…
High
CVE-2021-44205
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) b…
High
CVE-2021-44204
Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) be…
Medium
CVE-2021-44886
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notif…
2022-02-03
High
CVE-2022-24121
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter.
2022-01-26
Critical
CVE-2022-21686
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy l…
2022-01-14
Medium
CVE-2021-44739
Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenti…
2022-01-11
High
CVE-2022-21840
Microsoft Office Remote Code Execution Vulnerability
2021-12-15
Critical
CVE-2021-43905
Microsoft Office app Remote Code Execution Vulnerability
High
CVE-2021-43875
Microsoft Office Graphics Remote Code Execution Vulnerability
Medium
CVE-2021-43255
Microsoft Office Trust Center Spoofing Vulnerability
2021-12-13
High
CVE-2021-43817
Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject une…
2021-11-29
Medium
CVE-2021-44199
DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Pr…
2021-11-01
Medium
CVE-2021-20839
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS)…
High
CVE-2021-20838
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS)…
2021-10-13
High
CVE-2021-40481
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2021-40480
Microsoft Office Visio Remote Code Execution Vulnerability
2021-09-29
Medium
CVE-2021-39855
Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Information Disclosure vulnerability. An unau…
2021-09-27
Medium
CVE-2021-37786
Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0…
2021-09-23
Medium
CVE-2021-34705
A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination…
2021-09-15
High
CVE-2021-40444
<p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerabil…
High
CVE-2021-38660
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2021-38659
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2021-38658
Microsoft Office Graphics Remote Code Execution Vulnerability
Medium
CVE-2021-38657
Microsoft Office Graphics Component Information Disclosure Vulnerability
High
CVE-2021-38654
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2021-38653
Microsoft Office Visio Remote Code Execution Vulnerability
High
CVE-2021-38650
Microsoft Office Spoofing Vulnerability
High
CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
2021-09-14
Medium
CVE-2021-38175
SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change information in the current system without user i…
2021-09-07
Medium
CVE-2021-37629
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enu…
High
CVE-2021-37628
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud R…
2021-08-12
High
CVE-2020-18462
File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file.
High
CVE-2021-34478
Microsoft Office Remote Code Execution Vulnerability
2021-08-11
Critical
CVE-2021-33793
Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during Office document conversion.
2021-07-27
Medium
CVE-2021-32748
Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicate with the Collabora Editor, the communi…
2021-07-21
High
CVE-2021-32745
Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable…
Critical
CVE-2021-32744
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by ot…
2021-07-16
Medium
CVE-2021-34451
Microsoft Office Online Server Spoofing Vulnerability
2021-07-14
High
CVE-2021-34469
Microsoft Office Security Feature Bypass Vulnerability
Medium
CVE-2021-36374
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. Th…
2021-06-08
High
CVE-2021-31941
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2021-31940
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2021-34280
Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someon…
2021-05-11
High
CVE-2021-31180
Microsoft Office Graphics Remote Code Execution Vulnerability
High
CVE-2021-31179
Microsoft Office Remote Code Execution Vulnerability
Medium
CVE-2021-31178
Microsoft Office Information Disclosure Vulnerability
High
CVE-2021-31177
Microsoft Office Remote Code Execution Vulnerability
High
CVE-2021-31176
Microsoft Office Remote Code Execution Vulnerability
High
CVE-2021-31175
Microsoft Office Remote Code Execution Vulnerability
2021-04-29
Medium
CVE-2021-21391
CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media…
2021-04-14
Medium
CVE-2021-28060
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
Medium
CVE-2020-35419
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
Medium
CVE-2020-35418
Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.
2021-04-13
High
CVE-2021-28449
Microsoft Office Remote Code Execution Vulnerability
2021-03-31
Medium
CVE-2021-21418
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front offic…
2021-03-18
Medium
CVE-2021-20634
Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App via unspecified vec…
Medium
CVE-2021-20633
Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.
Medium
CVE-2021-20632
Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Bulletin Board via unspeci…
Medium
CVE-2021-20631
Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to alter the data of Custom App via unspecified vectors.
Medium
CVE-2021-20630
Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspeci…
Medium
CVE-2021-20629
Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
Medium
CVE-2021-20628
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs…
Medium
CVE-2021-20627
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
Medium
CVE-2021-20626
Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors.
Medium
CVE-2021-20625
Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspec…
Medium
CVE-2021-20624
Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Scheduler via unspecified vect…
2021-03-11
High
CVE-2021-27059
Microsoft Office Remote Code Execution Vulnerability
High
CVE-2021-27058
Microsoft Office ClickToRun Remote Code Execution Vulnerability
High
CVE-2021-27057
Microsoft Office Remote Code Execution Vulnerability
High
CVE-2021-24108
Microsoft Office Remote Code Execution Vulnerability
2021-02-23
High
CVE-2020-28587
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, whic…
Medium
CVE-2021-27550
Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a local denial of service. To exploit the vulnerability, someone must open a craft…
2021-02-10
High
CVE-2020-27250
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a particular record type into a static-sized b…
High
CVE-2020-13581
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a particular record type into a buffer that is…
High
CVE-2020-13546
In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the document parser to miscalculate a length used to allocate a buffer, later upon u…
2021-02-04
High
CVE-2020-27249
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, whic…
High
CVE-2020-27248
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, whic…
High
CVE-2020-27247
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, whic…
High
CVE-2020-13586
A memory corruption vulnerability exists in the Excel Document SST Record 0x00fc functionality of SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014). A specially crafted malforme…
High
CVE-2020-13580
An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause…
High
CVE-2020-13579
An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the docum…
2021-01-26
Medium
CVE-2020-23447
newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write xss payload in their address information when buying goods, which is triggered when viewing the "View…
2021-01-12
High
CVE-2021-1711
Microsoft Office Remote Code Execution Vulnerability
Medium
CVE-2021-21470
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which…
2021-01-07
Critical
CVE-2020-13451
An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.
2021-01-06
High
CVE-2020-13545
An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the docu…
High
CVE-2020-13544
An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the documen…