Remote code execution

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint...

CVE-2020-16953

CVE-2020-16953 is an information-disclosure vulnerability in Microsoft SharePoint Server caused by improper handling of objects in memory. Exploitation requires an attacker to log on to an affected system and run a crafted application, enabling them to obtain sensitive information to further comp...

CVE-2020-16953 Microsoft SharePoint Information Disclosure Vulnerability

...

CVE-2020-16952 Microsoft SharePoint Remote Code Execution Vulnerability

...

CVE-2020-16951 Microsoft SharePoint Remote Code Execution Vulnerability

...

CVE-2020-16951

CVE-2020-16951 affects Microsoft SharePoint Server where the product fails to validate the source markup of an uploaded application package. The root cause is incorrect checking of source markup during package processing, enabling arbitrary code execution in the SharePoint application pool and fa...

CVE-2020-16952

CVE-2020-16952 is a Microsoft SharePoint Remote Code Execution vulnerability where failure to validate the source markup of an application package allows an attacker to execute arbitrary code in the SharePoint app pool and server farm context. Exploitation requires uploading a specially crafted S...

CVE-2020-16950

CVE-2020-16950: Information disclosure in Microsoft SharePoint Server due to improper handling of in-memory objects. An attacker who can log in and run a crafted application could obtain information to further compromise the system. The vulnerability is addressed by a security update that fixes h...

CVE-2020-16950 Microsoft SharePoint Information Disclosure Vulnerability

...

EUVD-2020-8908

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit the vulnerability, an attacker would...

CVE-2020-16948

CVE-2020-16948 : A information-disclosure vulnerability in Microsoft SharePoint Server arises when the server fails to properly handle objects in memory, allowing an attacker who can log on and run a crafted application to obtain information that could help further compromise the system. The issu...

CVE-2020-16948 Microsoft SharePoint Information Disclosure Vulnerability

...

CVE-2020-16946 Microsoft Office SharePoint XSS Vulnerability

...

CVE-2020-16945

CVE-2020-16945 concerns a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where specially crafted web requests are not properly sanitized. An authenticated attacker could send such a request and, if successful, execute scripts in the security context of the current user. T...

CVE-2020-16946

The CVE-2020-16946 entry refers to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where crafted web requests are not properly sanitized. The authenticated attacker could execute scripts in the user’s browser context, potentially reading restricted content and performing...

CVE-2020-16945 Microsoft Office SharePoint XSS Vulnerability

...

CVE-2020-16944 Microsoft SharePoint Reflective XSS Vulnerability

...

CVE-2020-16944

CVE-2020-16944 describes a cross-site scripting (XSS) vulnerability in SharePoint Server caused by improper sanitization of specially crafted requests. An authenticated attacker could lure a user to click a crafted URL (via email, instant messenger, or a compromised site) and execute scripts in t...

CVE-2020-16941 Microsoft SharePoint Information Disclosure Vulnerability

...

CVE-2020-16942

CVE-2020-16942 is an information-disclosure vulnerability in Microsoft SharePoint Server. The issue arises when rendering specific web pages, allowing an attacker with access to the affected page to view the folder path of scripts loaded on that page due to improper disclosure of folder structure...