CVE-2019-1296

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1295...

CVE-2019-1295

CVE-2019-1295 is a remote code execution vulnerability in Microsoft SharePoint where APIs aren’t properly protected from unsafe input. The connected Nessus plugins describe multiple vulnerabilities affecting Microsoft SharePoint Server (e.g., 2019 and 2016 builds) including this CVE, with the iss...

CVE-2019-1296

CVE-2019-1296 is a remote code execution vulnerability in Microsoft SharePoint. The issue arises because APIs aren’t properly protected from unsafe input data, enabling potentially arbitrary code execution in the context of the SharePoint server. Reports in connected sources confirm the vulnerabi...

CVE-2019-1262

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'...

CVE-2019-1260

An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'...

CVE-2019-1261

Microsoft SharePoint vulnerable to a spoofing/CSRF issue in which improper handling of requests to authorize applications can allow an attacker to perform cross-site requests. CVE-2019-1261 is the associated entry, distinct from CVE-2019-1259. Connected documents also reference related SharePoint...

CVE-2019-1260

CVE-2019-1260 is an elevation-of-privilege vulnerability in Microsoft SharePoint. The vulnerability is described as allowing an attacker to impersonate a user or gain higher privileges via vulnerable SharePoint components. Public references in connected documents indicate affected SharePoint Serv...

CVE-2019-1262

CVE-2019-1262 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by improper sanitization of certain web requests. An authenticated attacker could exploit this by sending a crafted request to an affected SharePoint server, enabling the attacker to execute scripts ...

CVE-2019-1261

A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery CSRF.To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka...

CVE-2019-1259

A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery CSRF.To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka...

CVE-2019-1259

CVE-2019-1259 is a Microsoft SharePoint CSRF/spoofing vulnerability. The initial description and multiple connected entries indicate the issue arises when SharePoint improperly handles requests to authorize applications, enabling cross-site request forgery via a malicious page. The vulnerability ...

CVE-2019-1257

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296...

CVE-2019-1257

CVE-2019-1257 is a Microsoft SharePoint Remote Code Execution vulnerability where APIs fail to check the source markup of an uploaded application package. The issue is documented across multiple sources as affecting SharePoint Server (version lines cited by Nessus plugins), with the root cause be...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2019-34772)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2019-34770)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2019-34771)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

September Patch Tuesday – 79 Vulns, 17 Critical, Remote Desktop Client, SharePoint, Exploited PrivEsc

This month’s Microsoft Patch Tuesday addresses 79 vulnerabilities with 17 of them labeled as Critical. Of the 17 Critical vulns, 8 are for scripting engines and browsers, 4 are for the Remote Desktop Client, and 3 are for SharePoint. In addition, Microsoft has again patched a critical vulnerabili...

Microsoft Patch Tuesday — Sept. 2019: Vulnerability disclosures and Snort coverage

By Jon Munshaw. Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 85 vulnerabilities, 19 of which are rated “critical," 65 that are considered "important" and one "moderate." There is also a...

Security Update for Microsoft SharePoint Foundation 2013 (KB4484099) farm-deployment

A security vulnerability exists in Microsoft SharePoint Foundation 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

Security Update for Microsoft SharePoint Foundation 2013 (KB4484099)

A security vulnerability exists in Microsoft SharePoint Foundation 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...