Office Web Components
Vendor:
First CVE: Sep 24, 2002 · Active for 23 years
13
Total CVEs
More Total CVEs than 91% of tracked products
3.3
Avg CVEs / Year
Higher CVE frequency than 81% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
15.4%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Office Web Components over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 24, 2002
23 years ago
Most Recent CVE
Aug 15, 2012
5,091 days ago
CVE Severity & Scoring
Office Web Components13 CVEs
31%
69%
All CVEs352,294 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network2 (15.4%)
Unknown11 (84.6%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low2 (15.4%)
High0 (0.0%)
Unknown11 (84.6%)
User Interaction
None0 (0.0%)
Unknown11 (84.6%)
Required2 (15.4%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None2 (15.4%)
Unknown11 (84.6%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-0158HIGH The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Go | Apr 10, 2012 | 8.8 | 98 | YES | YES |
CVE-2012-1856HIGH The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Serv | Aug 15, 2012 | 8.8 | 92 | YES | NO |
CVE-2009-1136HIGH The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 | Jul 15, 2009 | 9.3 | 79 | NO | YES |
CVE-2009-1534HIGH Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visu | Aug 12, 2009 | 9.3 | 70 | NO | YES |
CVE-2006-4695HIGH Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via a crafted URL, aka "Off | Dec 31, 2006 | 9.3 | 43 | NO | NO |
CVE-2009-2496HIGH Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, O | Aug 12, 2009 | 9.3 | 39 | NO | NO |
CVE-2009-0562HIGH The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 | Aug 12, 2009 | 9.3 | 35 | NO | NO |
CVE-2002-0861HIGH Microsoft Office Web Components (OWC) 2000 and 2002 allows remote attackers to bypass the "Allow paste operations via script" setting, even when it is disabled, via the (1) Copy me | Sep 24, 2002 | 7.5 | 31 | NO | NO |
CVE-2002-0727HIGH The Host function in Microsoft Office Web Components (OWC) 2000 and 2002 is exposed in components that are marked as safe for scripting, which allows remote attackers to execute ar | Sep 24, 2002 | 7.5 | 27 | NO | NO |
CVE-2002-1338MEDIUM The Load method in the Chart component of Office Web Components (OWC) 9 and 10 generates an exception when a specified file does not exist, which allows remote attackers to determi | Dec 18, 2002 | 5.0 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
2 CVEs
15.4% of CVEs· 98th percentile
Metasploit
3 CVEs
23.1% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
3 CVEs
23.1% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Office Web Components
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| xp | 4 | 9.3 | 42.2% | 0 | 2 |
| 2003 | 6 | 9.2 | 51.0% | 2 | 3 |
| 2002 | 6 | 5.8 | 16.8% | 0 | 0 |
| 2000 | 7 | 8.2 | 28.6% | 0 | 1 |