Description of the security update for SharePoint Server 2010: July 14, 2020

Description of the security update for SharePoint Server 2010: July 14, 2020 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the followi...

PT-2020-3296 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to insufficient sanitization of web requests, which can lead to cross-site...

PT-2020-3297 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to insufficient sanitization of web requests in Microsoft SharePoint Server,...

PT-2020-3298 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server versions prior to the fixed version Microsoft SharePoint Enterprise Server versions prior to the fixed version Description: The issue is related to insufficient sanitization of web requests, allowing an attacker to...

PT-2020-3216 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Microsoft SharePoint Enterprise Server affected versions not specified Description: The issue is related to a cross-site scripting XSS attack, which occurs when the software does not...

PT-2020-3211

Name of the Vulnerable Software and Affected Versions PerformancePoint Services for SharePoint Server affected versions not specified Description A remote code execution issue exists due to the software's failure to properly check the source markup of XML file input. This could allow an attacker ...

PT-2020-3213

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Description A spoofing issue exists due to improper sanitization of specially crafted web requests by Microsoft SharePoint Server. This could allow an attacker to perform cross-site...

PT-2020-3078

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Skype for Business Server affected versions not specified Description An elevation of privilege issue occurs when Microsoft SharePoint Server and Skype for Business Server improperly...

PT-2020-3217

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Microsoft Office Online Server affected versions not specified Microsoft Office Web Apps Server affected versions not specified Microsoft SharePoint Server affected versions not specified...

PT-2020-3214

Name of the Vulnerable Software and Affected Versions Microsoft Word affected versions not specified Microsoft Office affected versions not specified Microsoft Office Online Server affected versions not specified Microsoft Office Web Apps Server affected versions not specified Microsoft SharePoin...

KLA11859 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Windows Diagnostics Hub...

CVE-2020-1025: Improper Input Validation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation. An attacker who successfully exploited the vulnerability could bypass authentication and achieve improper access. To exploit this vulnerability, ...

CVE-2020-1450: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1451, CVE-2020-1456...

CVE-2020-1451: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1456...

CVE-2020-1443: Undefined Security Weakness

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'...

CVE-2020-1439: Deserialization of Untrusted Data

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'...

CVE-2020-1456: Improper Neutralization of Input During Web Page Generation

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1451...

SRC-2020-0029 : Microsoft SharePoint Server DataFormParameter ParameterBinding Elevation of Privilege Vulnerability

Vulnerability Details: This vulnerability allows remote attackers escalate privileges on affected installations of Microsoft SharePoint Server when form based authentication is enabled. Authentication is required to exploit this vulnerability. The specific flaw exists within the Evaluate function...

SRC-2021-0001 : Microsoft SharePoint Server ContentEditorWebPart GetHttpWebResponse Server-Side Request Forgery Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose sensitive information on affected installations of SharePoint Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the ContentEditorWebPart class. The issue results from the...

SRC-2020-0023 : Microsoft SharePoint Server SoapDataSource GetResponseString Server-Side Request Forgery Information Disclosure Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to disclose information on affected installations of SharePoint Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the SoapDataSource class. The issue results from the lack of proper...