A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

The Microsoft Project installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  - A security feature bypass vulnerability exists when     Microsoft Office improperly handles input. An attacker     who successfully exploited the vulnerability could     execute arbitrary commands. In a file-sharing attack     scenario, an attacker could provide a specially crafted     document file designed to exploit the vulnerability, and     then convince a user to open the document file and     interact with the document by clicking a specific cell.
    The update addresses the vulnerability by correcting how     Microsoft Office handles input. (CVE-2019-1264)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-1246)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2019-1297)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2019-1263)

  - A security feature bypass vulnerability exists when     Microsoft Office improperly handles input. An attacker     who successfully exploited the vulnerability could     execute arbitrary commands. In a file-sharing attack     scenario, an attacker could provide a specially crafted     document file designed to exploit the vulnerability, and     then convince a user to open the document file and     interact with the document by clicking a specific cell.
    The update addresses the vulnerability by correcting how     Microsoft Office handles input. (CVE-2019-1264)

ID	Name	Product	Family	Severity
162102	Security Updates for Microsoft Project C2R (September 2019)	Nessus	Windows	high
162077	Security Updates for Microsoft Office Products C2R (September 2019)	Nessus	Windows	high
128686	Security Updates for Microsoft Project (September 2019)	Nessus	Windows : Microsoft Bulletins	high
128648	Security Updates for Microsoft Office Products (September 2019)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-1264

high

Tenable Plugins

high

high

high

high