| V-17187 | Medium | Trust Bar Notifications for unsigned application add-ins must be blocked. | If an application is configured to require all add-ins to be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust... |
| V-17184 | Medium | Links that invoke instances of Internet Explorer from within an Office product must be blocked. | The Pop-up Blocker feature in Internet Explorer can be used to block most unwanted pop-up and pop-under windows from appearing. This functionality can be controlled separately for instances of... |
| V-26707 | Medium | Fatally corrupt files must be blocked from opening. | Enabling this setting allows a user to open fatally corrupt Publisher 2013 files. As a result, malicious code or users could become active on the user's computer or the network. For example, a... |
| V-17173 | Medium | Disabling of user name and password syntax from being used in URLs must be enforced. | The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to... |
| V-17545 | Medium | Warning Bar settings for VBA macros must be configured. | When users open files containing VBA Macros, applications open the files with the macros disabled and displays the Trust Bar with a warning that macros are present and have been disabled. Users... |
| V-26589 | Medium | Add-ins to Office applications must be signed by a Trusted Publisher. | Office 2013 applications do not check the digital signature on application add-ins before opening them. Disabling or not configuring this setting may allow an application to load a dangerous... |
| V-40893 | Medium | The Internet Explorer Bind to Object functionality must be enabled. | Internet Explorer performs a number of safety checks before initializing an ActiveX control. It will not initialize a control if the kill bit for the control is set in the registry, or if the... |
| V-40895 | Medium | Navigation to URLs embedded in Office products must be blocked. | To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by... |
| V-40894 | Medium | The Saved from URL mark must be selected to enforce Internet zone processing. | Typically, when Internet Explorer loads a web page from a Universal Naming Convention (UNC) share that contains a Mark of the Web (MOTW) comment, indicating the page was saved from a site on the... |
| V-40896 | Medium | Scripted Window Security must be enforced. | Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computer in some manner. Disabling or not... |
| V-26708 | Medium | The Publisher Automation Security Level must be configured for high security. | When a separate application is used to launch Publisher 2013 programmatically, any macros can run in the programmatically-opened application without being blocked. Disabling or not configuring... |
| V-26587 | Medium | File Downloads must be configured for proper restrictions. | Disabling this setting allows websites to present file download prompts via code without the user specifically initiating the download. User preferences may also allow the download to occur... |
| V-26586 | Medium | ActiveX Installs must be configured for proper restriction. | Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like the other types of HTML or... |
| V-26585 | Medium | Protection from zone elevation must be enforced. | Internet Explorer places restrictions on each web page users can use the browser to open. Web pages on a user's local computer have the fewest security restrictions and reside in the Local Machine... |
| V-26584 | Medium | Add-on Management functionality must be allowed. | Internet Explorer add-ons are pieces of code, run in Internet Explorer, to provide additional functionality. Rogue add-ons may contain viruses or other malicious code. Disabling or not configuring... |
