CVE-2006-3014
Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadshee
CVSS
5.1
No CVSS
EPSS
30.1%
p98
KEV
—
Exploit Today
29
0-100
Published: Jun 22, 2006 · Last modified: Sep 23, 2026 · CWE-20
30.1%EPSS · 30 days30.1%
2026-10-112026-11-08
Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.
- archives.neohapsis.comhttp://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html
- hackingspirits.comhttp://hackingspirits.com/vuln-rnd/vuln-rnd.html
- secunia.comhttp://secunia.com/advisories/21865
- secunia.comhttp://secunia.com/advisories/22882
- securitytracker.comhttp://securitytracker.com/id?1016344
- www.adobe.comhttp://www.adobe.com/support/security/bulletins/apsb06-11.html
- www.securiteam.comhttp://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/18583
- www.securityfocus.comhttp://www.securityfocus.com/bid/19980
- www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA06-318A.html
- www.vupen.comhttp://www.vupen.com/english/advisories/2006/3573
- www.vupen.comhttp://www.vupen.com/english/advisories/2006/3577
- www.vupen.comhttp://www.vupen.com/english/advisories/2006/4507
- docs.microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
- exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/27312
- oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A538
- archives.neohapsis.comhttp://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html
- hackingspirits.comhttp://hackingspirits.com/vuln-rnd/vuln-rnd.html
- secunia.comhttp://secunia.com/advisories/21865
- secunia.comhttp://secunia.com/advisories/22882
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1192744.8 MED—
———Stored XSS attacks occur when an attacker injects a malicious script in Global Smart Folders feature in NIOS6hCVE-2026-842283.1 LOW—
——0IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.1dCVE-2026-185254.9 MED—
——0IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.1dCVE-2026-1236135.3 MED4.7%
——1Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.2dCVE-2026-1235747.5 HIG28.1%
——8The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.2dCVE-2026-1235737.5 HIG28.1%
——8hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.2d