CVE-2015-2503

highPriorität · verfolgen · 43EPSS 0.165 · 97. PerzentilEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

16.5% (97th) EPSS

CVSS 9.3 · high

Is it mine?

77 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

EPSS · bewertet 2026-10-27

Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.9–9.3

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 10

v2.09.3criticalAV:N/AC:M/Au:N/C:C/I:C/A:Csecondary · FSTEC (BDU) RU

v2.07.9highAV:N/AC:M/Au:N/C:C/I:C/A:C/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-264USprimärCWE-264US

betroffene Produkte (77)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
Microsoft Corp Access≤ 2016fstec_bduRU
Microsoft Corp Access≤ 2007 SP3fstec_bduRU
Microsoft Corp Access≤ 2010 SP2fstec_bduRU
Microsoft Corp Access≤ 2013 SP1fstec_bduRU
Microsoft Corp Microsoft Excel 2007 Service Pack 3alle Versionenfstec_bduRU
Microsoft Corp Microsoft Excel 2010 Service Pack 2alle Versionenfstec_bduRU
Microsoft Corp Microsoft Excel 2013 RT Service Pack 1alle Versionenfstec_bduRU
Microsoft Corp Microsoft Excel 2013 Service Pack 1alle Versionenfstec_bduRU
Microsoft Corp Microsoft Excel 2016alle Versionenfstec_bduRU
Microsoft Corp Microsoft InfoPath≤ 2010 SP2fstec_bduRU
Microsoft Corp Microsoft InfoPath≤ 2013 SP1fstec_bduRU
Microsoft Corp Microsoft InfoPath≤ 2007 SP3fstec_bduRU
Microsoft Corp Microsoft Lync≤ 2013 SP1fstec_bduRU
Microsoft Corp Microsoft OneNote 2007 Service Pack 3alle Versionenfstec_bduRU
Microsoft Corp Microsoft OneNote 2010 Service Pack 2alle Versionenfstec_bduRU
Microsoft Corp Microsoft OneNote 2013 RT Service Pack 1alle Versionenfstec_bduRU
Microsoft Corp Microsoft OneNote 2013 Service Pack 1alle Versionenfstec_bduRU
Microsoft Corp Microsoft OneNote 2016alle Versionenfstec_bduRU
Microsoft Corp Microsoft PowerPoint 2007 Service Pack 3alle Versionenfstec_bduRU

20 von 77 angezeigt

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

veröffentlicht 2015-11-11geändert 2026-06-17

verwandt (8,955)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-26169US	—OT kritisch	3.98% (90th)	KEV	2024-03-12
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2024-21338US	—OT kritisch	59.8% (99th)	KEV	2024-02-13
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-43208US	critical9.8OT kritisch	85.4% (100th)	KEV	2023-10-26
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-…
CVE-2023-29357US	—OT kritisch	100.0% (100th)	KEV	2023-06-14
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-20963US	high7.8OT kritisch	1.47% (74th)	KEV	2023-03-24
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…

+8950 weitere

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

http://technet.microsoft.com/security/bulletin/MS15-116 cnnvd
http://www.securitytracker.com/id/1034117 enisa_euvd
http://www.securitytracker.com/id/1034119 enisa_euvd
http://www.securitytracker.com/id/1034122 enisa_euvd
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-116 enisa_euvd
http://www.securitytracker.com/id/1034117Third Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id/1034119Third Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id/1034122Third Party AdvisoryVDB Entrynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan