Multiple vulnerabilities in Microsoft Office

Описание

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information, perform cross-site scripting attack, gain privileges.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Word can be exploited remotely via special crafted file to execute arbitrary code.
2. A remote code execution vulnerability in Microsoft Project can be exploited remotely via specially crafted file to execute arbitrary code.
3. A remote code execution vulnerability in .NET Framework, SharePoint Server, and Visual Studio can be exploited remotely via specially crafted document to execute arbitrary code.
4. A cross-site-scripting (XSS) vulnerability Microsoft SharePoint Reflective can be exploited remotely via specially crafted request to spoof user interface.
5. A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted to execute arbitrary code.
6. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
7. A cross-site-scripting (XSS) vulnerability in Office Web Apps can be exploited remotely via specially crafted request to spoof user interface.
8. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface.
9. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted email to execute arbitrary code.
10. An information disclosure vulnerability in Microsoft Office can be exploited to obtain sensitive information.
11. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
12. A remote code execution vulnerability in PerformancePoint Services can be exploited remotely via specially crafted document to execute arbitrary code.
13. A cross-site-scripting (XSS) vulnerability in Microsoft SharePoint Server can be exploited remotely via special crafted web to spoof user interface.
14. A remote code execution vulnerability in Microsoft Outlook can be exploited to execute arbitrary code.
15. An elevation of privilege vulnerability in Microsoft OneDrive can be exploited remotely via specially crafted application to gain privileges.
16. A cross-site-scripting (XSS) vulnerability in Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
17. An information disclosure vulnerability in Microsoft Office can be exploited remotely via specially crafted file to obtain sensitive information.
18. A remote code execution vulnerability in DirectWrite can be exploited remotely via specially crafted document to execute arbitrary code.
19. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
20. An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges.

Первичный источник обнаружения

• CVE-2020-1448
  CVE-2020-1449
  CVE-2020-1147
  CVE-2020-1454
  CVE-2020-1458
  CVE-2020-1456
  CVE-2020-1442
  CVE-2020-1443
  CVE-2020-1444
  CVE-2020-1445
  CVE-2020-1446
  CVE-2020-1447
  CVE-2020-1439
  CVE-2020-1451
  CVE-2020-1349
  CVE-2020-1465
  CVE-2020-1450
  CVE-2020-1342
  CVE-2020-1409
  CVE-2020-1240
  CVE-2020-1025
  

Эксплуатация

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

• Microsoft-.NET-Framework
• Microsoft-Office
• Microsoft-Outlook
• Microsoft-Excel
• Microsoft-Word
• Microsoft-Sharepoint-Server

Список CVE

• CVE-2020-1147
  high
• CVE-2020-1409
  critical
• CVE-2020-1448
  high
• CVE-2020-1449
  critical
• CVE-2020-1454
  warning
• CVE-2020-1458
  critical
• CVE-2020-1456
  warning
• CVE-2020-1442
  warning
• CVE-2020-1443
  warning
• CVE-2020-1444
  warning
• CVE-2020-1445
  warning
• CVE-2020-1446
  high
• CVE-2020-1447
  high
• CVE-2020-1439
  high
• CVE-2020-1451
  warning
• CVE-2020-1349
  high
• CVE-2020-1465
  high
• CVE-2020-1450
  warning
• CVE-2020-1342
  warning
• CVE-2020-1240
  critical
• CVE-2020-1025
  critical

Список KB

• 4484443
• 4484441
• 4484440
• 4484446
• 4484357
• 4484370
• 4484448
• 4484353
• 4484374
• 4484463
• 4484460
• 4484363
• 4484450
• 4484451
• 4484452
• 4484453
• 4484348
• 4484433
• 4484456
• 4484458
• 4484438
• 4484436
• 4484381
• 4484382
• 4484411
• 4571332
• 4571333
• 4571334

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com