CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Reader and Acrobat Heap-Based Buffer Overflow Vulnerability (CVE-2009-3459) Analysis and Mitigation Guide
[Affected Scope] Adobe Reader and Acrobat versions 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2
[Impact] Remote attackers can execute arbitrary code and compromise the host system by tricking a user into opening a specially crafted PDF file
[Mitigation] Immediately upgrade to the patched versions (7.1.4, 8.1.7, or 9.2 and above) and restrict opening untrusted PDF attachments
Adobe Reader, Acrobat, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862, authplay.dll Memory Corruption)
[Affected Scope] Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87
[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a crafted Flash application in a .pdf file or a crafted .swf file
[Mitigation] Immediately upgrade to the latest patched versions, or apply workarounds such as disabling or renaming the authplay.dll component to prevent exploitation
Microsoft Excel Object Record Corruption Remote Code Execution Vulnerability (CVE-2009-0557, MS09-021)
[Affected Scope] Microsoft Office 2000 SP3, XP SP3, 2003 SP3, 2007 SP1/SP2, Office for Mac 2004/2008, Excel Viewer, and Compatibility Pack
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Excel file
[Mitigation] Immediately apply the official Microsoft MS09-021 security update and restrict the execution of untrusted spreadsheet files
Microsoft Office Word Stack-Based Buffer Overflow Vulnerability (CVE-2009-0563) Technical Advisory
[Affected Scope] Microsoft Office Word 2002/2003/2007, Office for Mac 2004/2008, Word Viewer, and Compatibility Pack
[Impact] Remote attackers can execute arbitrary code via a specially crafted Word document containing an invalid length field in a tag
[Mitigation] Apply the official Microsoft security update (MS09-027) immediately and restrict execution of untrusted document files
Microsoft DirectX DirectShow QuickTime Parser Remote Code Execution Vulnerability (CVE-2009-1537, KEV Listed)
[Affected Scope] DirectShow (quartz.dll) in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2
[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a specially crafted QuickTime media file
[Mitigation] Apply the official Microsoft security updates (MS09-028) or disable the QuickTime Movie Parser Filter via registry modification (Kill-bit)
Microsoft Excel Invalid Object Reference Remote Code Execution Vulnerability (CVE-2009-0238) Advisory
[Affected Scope] Microsoft Office Excel 2000 through 2007, Excel Viewer, Office for Mac 2004/2008, and Compatibility Pack.
[Impact] Opening a specially crafted Excel document can trigger an access attempt on an invalid object, allowing remote attackers to execute arbitrary code.
[Mitigation] Apply the official Microsoft security patches immediately and restrict opening untrusted Excel attachments.
Microsoft Windows Server Service Remote Code Execution Vulnerability (MS08-067, CVE-2008-4250)
[Affected Scope] Microsoft Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7 Pre-Beta
[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges and gain full control of the target system via crafted RPC requests
[Mitigation] Apply the official Microsoft security patch (MS08-067) immediately and restrict external access to SMB ports (TCP 139/445)
Adobe Reader and Acrobat Buffer Overflow Remote Code Execution Vulnerability (CVE-2007-5659)
[Affected Scope] Adobe Reader and Acrobat 8.1.1 and earlier
[Impact] Remote attackers can execute arbitrary code via a specially crafted PDF file containing malicious JavaScript
[Mitigation] Upgrade to the latest patched version or disable JavaScript execution within Adobe Reader/Acrobat
Adobe Reader and Acrobat Multiple Unspecified Vulnerabilities Security Advisory (CVE-2008-0655)
[Affected Scope] Adobe Reader and Acrobat versions prior to 8.1.2 across all platforms
[Impact] Remote attackers can execute arbitrary code or cause information disclosure by tricking users into opening a specially crafted PDF document
[Mitigation] Immediately upgrade to Adobe Reader/Acrobat version 8.1.2 or later, or transition to the latest supported Acrobat Reader DC
Microsoft Excel Remote Code Execution (RCE) Zero-Day Vulnerability (CVE-2007-0671)
[Affected Scope] Microsoft Excel 2000, XP, 2003, Excel 2004 for Mac, and potentially other legacy Office products
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Excel file
[Mitigation] Apply official Microsoft security patches immediately, restrict opening untrusted Excel attachments, and enforce strict macro execution policies
Microsoft Word and Office Suite Remote Code Execution Vulnerability (CVE-2006-2492)
[Affected Scope] Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1/SP2, and Microsoft Works Suite through 2006
[Impact] Remote attackers can execute arbitrary code and gain full system control by tricking a user into opening a specially crafted malicious Word (.doc) document
[Mitigation] Apply the official Microsoft security patch (MS06-027) immediately, and restrict the execution of untrusted email attachments