Microsoft Office Online Server
By the Year
In 2021 there have been 12 vulnerabilities in Microsoft Office Online Server with an average score of 7.8 out of ten. Last year Office Online Server had 29 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Office Online Server in 2021 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2021 is greater by 0.50.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2021 | 12 | 7.80 |
| 2020 | 29 | 7.30 |
| 2019 | 10 | 7.29 |
| 2018 | 6 | 6.82 |
It may take a day or so for new Office Online Server vulnerabilities to show up. Additionally vulnerabilities may be tagged under a different product or component name.
Latest Microsoft Office Online Server Security Vulnerabilities
Microsoft Word Remote Code Execution Vulnerability
CVE-2021-28453
7.8 - High
- April 13, 2021
Microsoft Word Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-28451
7.8 - High
- April 13, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28454.
Microsoft Office Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-27057
7.8 - High
- March 11, 2021
Microsoft Office Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24108, CVE-2021-27059.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-27054
7.8 - High
- March 11, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-27053.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-27053
7.8 - High
- March 11, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-27054.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-24070
7.8 - High
- February 25, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24067, CVE-2021-24068, CVE-2021-24069.
Dangling pointer
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-24069
7.8 - High
- February 25, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24067, CVE-2021-24068, CVE-2021-24070.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-24067
7.8 - High
- February 25, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24068, CVE-2021-24069, CVE-2021-24070.
Dangling pointer
Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-1716
7.8 - High
- January 12, 2021
Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1715.
Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-1715
7.8 - High
- January 12, 2021
Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1716.
Memory Corruption
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-1714
7.8 - High
- January 12, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1713.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2021-1713
7.8 - High
- January 12, 2021
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1714.
Buffer Overflow
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2020-17125
7.8 - High
- December 10, 2020
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17122, CVE-2020-17123, CVE-2020-17127, CVE-2020-17128, CVE-2020-17129.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2020-17123
7.8 - High
- December 10, 2020
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17122, CVE-2020-17125, CVE-2020-17127, CVE-2020-17128, CVE-2020-17129.
Microsoft Excel Information Disclosure Vulnerability
CVE-2020-17126
5.5 - Medium
- December 10, 2020
Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2020-17128
7.8 - High
- December 10, 2020
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17122, CVE-2020-17123, CVE-2020-17125, CVE-2020-17127, CVE-2020-17129.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2020-17129
7.8 - High
- December 10, 2020
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17122, CVE-2020-17123, CVE-2020-17125, CVE-2020-17127, CVE-2020-17128.
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique
CVE-2020-17065
7.8 - High
- November 11, 2020
Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17019, CVE-2020-17064, CVE-2020-17066.
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2020-16932
7.8 - High
- October 16, 2020
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16929, CVE-2020-16930, CVE-2020-16931.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2020-16929
7.8 - High
- October 16, 2020
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16930, CVE-2020-16931, CVE-2020-16932.
Dangling pointer
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2020-16931
7.8 - High
- October 16, 2020
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16929, CVE-2020-16930, CVE-2020-16932.
Use of Uninitialized Resource
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-1218
8.8 - High
- September 11, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1338.
Code Injection
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory
CVE-2020-1224
5.5 - Medium
- September 11, 2020
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Information Disclosure
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2020-1335
8.8 - High
- September 11, 2020
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1193, CVE-2020-1332, CVE-2020-1594.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-1338
8.8 - High
- September 11, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1218.
Code Injection
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory
CVE-2020-1583
5.5 - Medium
- August 17, 2020
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory, aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1502, CVE-2020-1503.
Information Disclosure
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory
CVE-2020-1503
5.5 - Medium
- August 17, 2020
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory, aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1502, CVE-2020-1583.
Information Disclosure
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory
CVE-2020-1502
5.5 - Medium
- August 17, 2020
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory, aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1503, CVE-2020-1583.
Information Disclosure
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2020-1495
8.8 - High
- August 17, 2020
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494, CVE-2020-1496, CVE-2020-1498, CVE-2020-1504.
Buffer Overflow
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory
CVE-2020-1445
5.5 - Medium
- July 14, 2020
An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1342.
Information Disclosure
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-1448
8.8 - High
- July 14, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1446, CVE-2020-1447.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-1446
8.8 - High
- July 14, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1447, CVE-2020-1448.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-1447
8.8 - High
- July 14, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1446, CVE-2020-1448.
Buffer Overflow
A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request
CVE-2020-1442
6.1 - Medium
- July 14, 2020
A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.
XSS
An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable
CVE-2020-1342
5.5 - Medium
- July 14, 2020
An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1445.
Use of Uninitialized Resource
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-0980
7.8 - High
- April 15, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-0892
7.8 - High
- March 12, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-0852
7.8 - High
- March 12, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0855, CVE-2020-0892.
Buffer Overflow
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2020-0850
8.8 - High
- March 12, 2020
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0851, CVE-2020-0852, CVE-2020-0855, CVE-2020-0892.
Buffer Overflow
A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly
CVE-2020-0695
5.4 - Medium
- February 11, 2020
A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'.
Improper Input Validation
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly
CVE-2020-0647
5.4 - Medium
- January 14, 2020
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vulnerability'.
Improper Input Validation
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly
CVE-2019-1445
5.4 - Medium
- November 12, 2019
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447.
Origin Validation Error
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory
CVE-2019-1446
5.5 - Medium
- November 12, 2019
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Information Disclosure
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly
CVE-2019-1447
5.4 - Medium
- November 12, 2019
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445.
Origin Validation Error
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory
CVE-2019-1331
8.8 - High
- October 10, 2019
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1327.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-1205
7.8 - High
- August 14, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1201.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-1201
7.8 - High
- August 14, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1205.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-1035
7.8 - High
- June 12, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1034.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-1034
7.8 - High
- June 12, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1035.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-0953
7.8 - High
- May 16, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory
CVE-2019-0585
8.8 - High
- January 08, 2019
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft SharePoint, Microsoft Office Online Server, Microsoft Word, Microsoft SharePoint Server.
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory
CVE-2018-8628
7.8 - High
- December 12, 2018
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office, Office 365 ProPlus, Microsoft PowerPoint, Microsoft SharePoint, Microsoft PowerPoint Viewer, Office Online Server, Microsoft SharePoint Server.
An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests
CVE-2018-8247
5.4 - Medium
- June 14, 2018
An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Office Online Server. This CVE ID is unique from CVE-2018-8245.
XSS
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016
CVE-2018-0922
7.8 - High
- March 14, 2018
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft Office Word Viewer, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft Office Compatibility Pack SP2, Microsoft Online Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2007 SP3, Microsoft Word 2010 SP2, Word 2013 and Microsoft Word 2016 allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Memory Corruption
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2010 SP2, Word 2013 SP1 and Microsoft Word 2016
CVE-2018-0919
3.3 - Low
- March 14, 2018
Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps 2013 SP1, Microsoft SharePoint Enterprise Server 2013 SP1, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2010 SP2, Microsoft Word 2010 SP2, Word 2013 SP1 and Microsoft Word 2016 allow an information disclosure vulnerability due to how variables are initialized, aka "Microsoft Office Information Disclosure Vulnerability".
Use of Uninitialized Resource
Microsoft Word 2016 in Microsoft Office 2016
CVE-2018-0792
8.8 - High
- January 10, 2018
Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0794.
Memory Corruption
Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016
CVE-2018-0797
7.8 - High
- January 10, 2018
Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word Memory Corruption Vulnerability".
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Word Viewer or by Microsoft? Click the Watch button to subscribe.
