CVE-2006-3014
MediumExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.
Risk Assessment
A user opening a malicious Excel file may be redirected to malicious sites or execute dangerous code, potentially leading to system infection or data theft.
Recommendation
Be cautious when opening Excel files from unknown sources and update Excel and Flash Player to the latest versions.
Other vulnerabilities in Microsoft Excel
See all- CVE-2024-26257High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to execute malicious code on the compromised device.
- CVE-2023-23398High
A vulnerability in Microsoft Excel allows for spoofing, which may lead to unauthorized access to user data. An attacker can exploit this flaw to mislead the user into opening a malicious file.
- CVE-2022-29109High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to run malicious software on the infected device.
- CVE-2022-26901High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2022-24473High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2022-21841High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
- CVE-2021-43256High
A vulnerability in Microsoft Excel allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.
- CVE-2023-33133High
A vulnerability in Microsoft Excel allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw through malicious Excel files.
- CVE-2021-42292HighActively exploited
Microsoft Excel Security Feature Bypass Vulnerability. Details are not provided in the description, but it allows an attacker to bypass security features.
- CVE-2021-38655High
Vulnerability in Microsoft Excel allows remote code execution. An attacker could exploit it to run arbitrary code on the victim's system.
Original NVD description (English source)
Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.