{"api_version":"1","generated_at":"2026-07-23T14:21:24+00:00","cve":"CVE-2006-3014","urls":{"html":"https://cve.report/CVE-2006-3014","api":"https://cve.report/api/cve/CVE-2006-3014.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3014","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3014"},"summary":{"title":"CVE-2006-3014","description":"Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-06-22 00:06:00","updated_at":"2018-10-12 21:40:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27312","name":"excel-shockwave-code-execution(27312)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A538","name":"oval:org.mitre.oval:def:538","refsource":"OVAL","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.us-cert.gov/cas/techalerts/TA06-318A.html","name":"TA06-318A","refsource":"CERT","tags":["US Government Resource"],"title":"US-CERT Technical Cyber Security Alert TA06-318A -- Microsoft Security Updates for Windows, Internet Explorer, and Adobe Flash","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html","name":"20060620 Microsoft Excel File Embedded Shockwave Flash Object Exploit","refsource":"FULLDISC","tags":["Exploit"],"title":"Neohapsis Archives - Full Disclosure List - #0414 - [Full-disclosure] Microsoft Excel File Embedded Shockwave Flash Object Exploit","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/4507","name":"ADV-2006-4507","refsource":"VUPEN","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.adobe.com/support/security/bulletins/apsb06-11.html","name":"http://www.adobe.com/support/security/bulletins/apsb06-11.html","refsource":"CONFIRM","tags":[],"title":"Adobe - Security Advisories : Multiple Vulnerabilities in Adobe Flash Player 8.0.24.0 and Earlier Versions","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3573","name":"ADV-2006-3573","refsource":"VUPEN","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21865","name":"21865","refsource":"SECUNIA","tags":["Patch","Vendor Advisory"],"title":"Adobe Flash Player Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://hackingspirits.com/vuln-rnd/vuln-rnd.html","name":"http://hackingspirits.com/vuln-rnd/vuln-rnd.html","refsource":"MISC","tags":["Exploit"],"title":"hackingspirits.com -&nbsphackingspirits Resources and Information.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/19980","name":"19980","refsource":"BID","tags":["Patch"],"title":"Adobe Flash Player Multiple Remote Code Execution Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/22882","name":"22882","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Microsoft Windows Flash Player Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html","name":"http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html","refsource":"MISC","tags":[],"title":"SecuriTeam™ - Microsoft Excel File Embedded Shockwave Flash Object Local Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069","name":"MS06-069","refsource":"MS","tags":[],"title":"Microsoft Security Bulletin MS06-069 - Critical | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/18583","name":"18583","refsource":"BID","tags":["Exploit"],"title":"Microsoft Office Embedded Shockwave Flash Object Security Bypass Weakness","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1016344","name":"1016344","refsource":"SECTRACK","tags":[],"title":"SecurityTracker.com Archives - Microsoft Excel 'Shockwave Flash Object' Lets Remote Users Execute Code Automatically","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3577","name":"ADV-2006-3577","refsource":"VUPEN","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3014","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3014","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3014","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"excel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3014","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"excel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3014","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2006-3573","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3573"},{"name":"TA06-318A","refsource":"CERT","url":"http://www.us-cert.gov/cas/techalerts/TA06-318A.html"},{"name":"ADV-2006-4507","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/4507"},{"name":"19980","refsource":"BID","url":"http://www.securityfocus.com/bid/19980"},{"name":"22882","refsource":"SECUNIA","url":"http://secunia.com/advisories/22882"},{"name":"21865","refsource":"SECUNIA","url":"http://secunia.com/advisories/21865"},{"name":"20060620 Microsoft Excel File Embedded Shockwave Flash Object Exploit","refsource":"FULLDISC","url":"http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html"},{"name":"http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html","refsource":"MISC","url":"http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html"},{"name":"http://hackingspirits.com/vuln-rnd/vuln-rnd.html","refsource":"MISC","url":"http://hackingspirits.com/vuln-rnd/vuln-rnd.html"},{"name":"http://www.adobe.com/support/security/bulletins/apsb06-11.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb06-11.html"},{"name":"oval:org.mitre.oval:def:538","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A538"},{"name":"ADV-2006-3577","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3577"},{"name":"18583","refsource":"BID","url":"http://www.securityfocus.com/bid/18583"},{"name":"excel-shockwave-code-execution(27312)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27312"},{"name":"MS06-069","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"},{"name":"1016344","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016344"}]}},"nvd":{"publishedDate":"2006-06-22 00:06:00","lastModifiedDate":"2018-10-12 21:40:00","problem_types":["CWE-20"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":5.1},"severity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":true,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:microsoft:excel:*:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3014","Ordinal":"18334","Title":"CVE-2006-3014","CVE":"CVE-2006-3014","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3014","Ordinal":"1","NoteData":"Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3014","Ordinal":"2","NoteData":"2006-06-21","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3014","Ordinal":"3","NoteData":"2018-10-12","Type":"Other","Title":"Modified"}]}}}