Design/Logic Flaw

Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote...

CVE-2015-1640

Cross-site scripting XSS vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."...

CVE-2015-1650

CVE-2015-1650 is a use-after-free vulnerability in Microsoft Word/Office components that allows remote code execution via crafted Office documents. Affected products include Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3,...

CVE-2015-1653

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."...

CVE-2015-1649

Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office...

CVE-2015-1649

CVE-2015-1649 is a use-after-free vulnerability in Microsoft Office components (Word 2007 SP3, Office 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2) that allows remote code execution via a crafted ...

CVE-2015-1653

CVE-2015-1653 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. Affected products include SharePoint Server and Foundation compon...

CVE-2015-1640

CVE-2015-1640 describes a cross-site scripting (XSS) vulnerability impacting Microsoft Project Server 2010 SP2 and 2013 SP1, attributed to insufficient input filtering in SharePoint/Project Server components. The core issue is improper sanitization of crafted requests that allows an attacker to i...

CVE-2015-1641

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute...

Microsoft SharePoint CVE-2015-1653 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

KLA10561 Code injection vulnerability in Microsoft Sharepoint

An XSS vulnerabilities were found in Microsoft Sharepoint. By exploiting these vulnerabilities malicious users can inject arbitrary scripts. These vulnerabilities can be exploited remotely via a specially designed request. Original advisories MS15-036 CVE-2015-1653 CVE-2015-1640 Related products...

Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

Description Microsoft Office is prone to a remote memory-corruption vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected...

Microsoft SharePoint CVE-2015-1640 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

MS15-036: Vulnerabilities in SharePoint Server could allow elevation of privilege: April 14, 2015

Resolves vulnerabilities in Microsoft Office server and productivity software that could allow elevation of privilege if an attacker sends a specially crafted request to an affected SharePoint Server.SummaryThis security update resolves vulnerabilities in Microsoft SharePoint Server and Microsoft...

Microsoft SharePoint Cross-site Scripting (MS15-036; CVE-2015-1653)

An elevation of privilege vulnerability exists in Microsoft SharePoint Server. The vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affecte...

PT-2015-1062 · Microsoft · Sharepoint Server +4

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions 2007 SP3 through 2013 SP1 Microsoft Word versions 2007 SP3 through 2013 SP1 Microsoft Word for Mac version 2011 Office Compatibility Pack version SP3 Word Automation Services on SharePoint Server versions 2010 SP2 an...

MS15-036: Vulnerabilities in Microsoft SharePoint Server Could Allow Elevation of Privilege (3052044)

The remote Windows host has a version of Microsoft SharePoint Server installed that is affected by multiple cross-site scripting vulnerabilities due to improper sanitization of specially crafted requests. An authenticated attacker can exploit these vulnerabilities to access unauthorized content a...

CVE-2015-1641

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2015-01631)

Microsoft SharePoint Server is an integrated suite of server capabilities that provides comprehensive content management and enterprise search, accelerates shared business processes, and facilitates information sharing across boundaries. Microsoft SharePoint Server fails to properly process...

CVE-2015-1636

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."...