Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.WEB_APPLICATION_SCANNING_112590
HistorySep 09, 2020 - 12:00 a.m.

Microsoft SharePoint Server 2016 < 16.0.5032.1002 Multiple Vulnerabilities

2020-09-0900:00:00
This script is Copyright (C) 2020-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
25
JSON

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :

  • A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input.

  • A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

  • A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

  • An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory.

  • An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation.

  • A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages.

  • An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory.

  • This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.

No source data
VendorProductVersionCPE
microsoftsharepoint_server*cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*

References

JSON