256 matches found
CVE-2020-1583
CVE-2020-1583 is a Microsoft Word information-disclosure vulnerability. An attacker could craft a document to cause Word to inappropriately disclose memory contents, enabling data compromise if the memory location of created objects is known. The vulnerability is triggered by memory handling of W...
CVE-2021-1707
CVE-2021-1707 is a remote code execution vulnerability in Microsoft SharePoint Server. The linked EUVD/Nessus entries and CNVD page confirm it affects SharePoint Server variants and stems from insufficient input validation, enabling code execution by a remote attacker over the network with no use...
CVE-2025-27747
CVE-2025-27747 is a Use-After-Free vulnerability in Microsoft Word (Office) that can allow an attacker to execute arbitrary code. The CVE is documented as affecting Word with a local attack vector and high impact (execution of code, confidentiality/integrity/availability potentially impacted). Pu...
CVE-2019-1295
CVE-2019-1295 is a remote code execution vulnerability in Microsoft SharePoint where APIs aren’t properly protected from unsafe input. The connected Nessus plugins describe multiple vulnerabilities affecting Microsoft SharePoint Server (e.g., 2019 and 2016 builds) including this CVE, with the iss...
CVE-2020-0973
Technical details for CVE-2020-0973 are not publicly available in the provided documents. No specific affected product/version or remediation is listed here. Monitor for updates.
CVE-2022-41122
CVE-2022-41122 is described in connected CNVD/NVD sources as a Microsoft SharePoint Server spoofing vulnerability. The CNVD entry notes that an attacker could exploit a specially crafted website to spoof content, tricking users into believing the site is legitimate. The available documents do not...
CVE-2020-1023
CVE-2020-1023 is a remote code execution vulnerability in Microsoft SharePoint described in the connected Nessus entries as affecting SharePoint Server versions that rely on self-reported version numbers: SharePoint Server 2013 < 15.0.5241.1000, SharePoint Server 2016 < 16.0.5005.1000, and ...
CVE-2020-1495
CVE-2020-1495 (Microsoft Excel) : A remote code execution via memory corruption in Excel occurs when the application fails to correctly handle objects in memory. An attacker who can lure a user to open a specially crafted Excel file (e.g., via email or a website) could execute arbitrary code in t...
CVE-2021-1641
CVE-2021-1641 is a session spoofing vulnerability affecting Microsoft SharePoint Server. The connected sources confirm affected products span SharePoint Server 2010 through 2019, with multiple related CVEs (e.g., CVE-2021-1707, CVE-2021-1712, CVE-2021-1715/1716/1717/1719) that were addressed in J...
CVE-2020-0980
CVE-2020-0980 is a Microsoft Word remote code execution vulnerability caused by improper handling of in-memory objects. It affects Word/Office when parsing crafted files; the impact is potential code execution in the current user context. In public docs, the vulnerability is addressed by the Offi...
CVE-2022-41060
CVE-2022-41060 is a Microsoft Word information disclosure vulnerability. The connected documents reference Word/Office components affected by the November 2022 updates and Office Web Apps Server updates (e.g., KB5002261, KB5002276) addressing Word information disclosure and related vulnerabilitie...
CVE-2022-41061
CVE-2022-41061 is a Microsoft Word remote code execution vulnerability. The CVSS v3.1 base score is 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, and user interaction required; impact is high for confidentiality, integrity, and availability. Affected: Microsoft Word / Office compon...
CVE-2025-29793
CVE-2025-29793 affects Microsoft SharePoint (Office SharePoint) and is a remote code execution vulnerability caused by deserialization of untrusted data. An authenticated attacker could execute code over the network on affected SharePoint deployments. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:L/PR:...
CVE-2020-1342
CVE-2020-1342 is an information-disclosure vulnerability in Microsoft Office (notably Word/Office components) caused by reading out of bound memory due to an uninitialized variable. The detail explicitly states memory contents could be disclosed when a vulnerable file is opened in affected Office...
CVE-2020-16953
CVE-2020-16953 is an information-disclosure vulnerability in Microsoft SharePoint Server caused by improper handling of objects in memory. Exploitation requires an attacker to log on to an affected system and run a crafted application, enabling them to obtain sensitive information to further comp...
CVE-2022-37961
CVE-2022-37961 is a remote code execution vulnerability in Microsoft SharePoint Server. The Connected KB describes a security update (KB5002271) for SharePoint Server Subscription Edition (16.0.x) released around Sep 13, 2022 that resolves this RCE alongside related SharePoint RCE advisories. Aff...
CVE-2020-16941
CVE-2020-16941 describes an information-disclosure vulnerability in Microsoft SharePoint Server where, on certain pages, the server improperly discloses the folder structure by revealing the folder path of scripts loaded on the page. An attacker must have access to the affected SharePoint page to...
CVE-2021-42309
CVE-2021-42309 is a remote code execution vulnerability in Microsoft SharePoint Server identified across multiple SharePoint versions (2013/2016/2019 and Subscription Edition). Public sources in the connected documents describe an RCE vector that allows an attacker to bypass authentication or exe...
CVE-2018-8284
CVE-2018-8284 is a remote code execution vulnerability in the Microsoft .NET Framework caused by improper input validation. The NVD entry lists affected runtimes across multiple versions (e.g., .NET Framework 2.0/3.0/3.5/3.5.1 and 4.x releases up to 4.7.2, including 4.6.x and 4.7.x). Microsoft MS...
CVE-2019-0957
CVE-2019-0957 is an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by improper sanitization of specially crafted web requests. The issue allows network-remote attack with low complexity to gain high-privilege access; CVSS v3 base score 8.8 (C:H/I:H/A:H) per NVD data. T...
CVE-2020-1503
CVE-2020-1503 is an information-disclosure vulnerability in Microsoft Word where memory contents can be disclosed through a crafted Word document. The root cause is improper handling of in‑memory objects, enabling disclosure of memory contents when a user opens a malicious document. Exploitation ...
CVE-2020-16948
CVE-2020-16948 : A information-disclosure vulnerability in Microsoft SharePoint Server arises when the server fails to properly handle objects in memory, allowing an attacker who can log on and run a crafted application to obtain information that could help further compromise the system. The issu...
CVE-2020-0971
SharePoint Remote Code Execution (CVE-2020-0971) is described as a vulnerability in Microsoft SharePoint where the software fails to validate the source markup of an application package, enabling remote code execution. Connected Nessus entries reference SharePoint Server versions (e.g., 2013, 201...
CVE-2020-1439
CVE-2020-1439 is a remote code execution vulnerability in Microsoft SharePoint’s PerformancePoint Services. The root cause, as stated in multiple sources, is that the service fails to validate the source markup of input XML, allowing an attacker to craft input that leads to code execution within ...
CVE-2021-1726
CVE-2021-1726 is a SharePoint Server spoofing vulnerability observed in multiple versions (2013/2016/2019). Exploitation involves spoofed content convincing users of a trusted site. Microsoft released updates (e.g., MS21-4493194/4493195 and related MSKBs) addressing this CVE; affected deployments...
CVE-2025-29794
CVE-2025-29794 is a Microsoft SharePoint Remote Code Execution vulnerability described as due to improper authorization in SharePoint, allowing an authenticated attacker to execute code over the network. The incident is documented across multiple sources confirming impact on SharePoint products a...
CVE-2020-0920
CVE-2020-0920 is a remote code execution vulnerability in Microsoft SharePoint where the system fails to check the source markup of an application package. Affected product: SharePoint Server. Impact: RCE with potential execution in the context of SharePoint. The connected analysis notes that thr...
CVE-2020-0923
Technical details for CVE-2020-0923 are not publicly provided in the supplied documents; no product/version/exploit data is available. Monitor for updates.
CVE-2020-1218
CVE-2020-1218 – Microsoft Word Remote Code Execution : A vulnerability in Word where memory handling of in-file objects can be corrupted by a specially crafted file. An attacker could exploit this via email or a compromised website by convincing a user to open the crafted Word document, executing...
CVE-2020-1501
CVE-2020-1501 is a Microsoft SharePoint Server spoofing vulnerability where a specially crafted web request is not properly sanitized, enabling an authenticated attacker to perform cross‑site scripting and execute actions in the user’s security context. The impact described in the sources include...
CVE-2020-16946
The CVE-2020-16946 entry refers to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where crafted web requests are not properly sanitized. The authenticated attacker could execute scripts in the user’s browser context, potentially reading restricted content and performing...
CVE-2020-0892
CVE-2020-0892 is a Microsoft Word remote code execution vulnerability. The linked documents confirm Word is vulnerable when it fails to properly handle objects in memory, allowing a crafted file to run code in the current user’s context. The issue is tied to multiple Word-related CVEs and is disc...
CVE-2020-1107
Technical details about CVE-2020-1107 are not publicly available in the provided connected documents. Monitor for updates from authoritative sources for affected products, impact, and fixes.
CVE-2020-1224
CVE-2020-1224 describes an information-disclosure vulnerability in Microsoft Excel where memory contents could be improperly disclosed. The issue arises when Excel handles objects in memory, allowing an attacker to craft a document that, if opened by a user, could reveal memory contents and poten...
CVE-2021-1716
CVE-2021-1716 is a Microsoft Word Remote Code Execution vulnerability. The initial entry confirms a Word-related RCE with CVSS v3.1 base score 7.8 (HIGH) and local attack vector, with user interaction required. Connected sources (Nessus/Office/SharePoint plugin data) reference CVE-2021-1716 as pa...
CVE-2021-24066
CVE-2021-24066 is a Microsoft SharePoint remote code execution vulnerability. Connected sources confirm it affects SharePoint Server (2013/2016/2019) and is addressed by February 2021 security updates (MS21-4493xx). The CVE is listed among multiple vulnerabilities; explicit exploitation details a...
CVE-2022-41103
CVE-2022-41103 is Microsoft Word Information Disclosure Vulnerability. Connected sources indicate it is referenced alongside Word/Office and SharePoint update bundles (e.g., Word C2R and SharePoint November 2022 patches). The vulnerability is described as information disclosure; no explicit root-...
CVE-2018-0789
CVE-2018-0789 affects Microsoft SharePoint Foundation 2010, and SharePoint Server 2013/2016. It is an elevation-of-privilege vulnerability caused by how web requests are handled, enabling an attacker to escalate privileges via network access with low complexity and no user interaction. The connec...
CVE-2020-0954
Technical details for CVE-2020-0954 are not publicly available in the provided documents. Monitor for updates from official sources.
CVE-2019-1260
CVE-2019-1260 is an elevation-of-privilege vulnerability in Microsoft SharePoint. The vulnerability is described as allowing an attacker to impersonate a user or gain higher privileges via vulnerable SharePoint components. Public references in connected documents indicate affected SharePoint Serv...
CVE-2020-0976
CVE-2020-0976 is a SharePoint Server spoofing vulnerability. The entry notes improper sanitization of a crafted web request to affected SharePoint servers, enabling spoofing. Nessus/patch data in connected documents indicate this CVE is included in Microsoft’s April 2020 updates, with remediation...
CVE-2020-0930
Technical details (affected products, versions, vulnerability root cause, impact, and remediation) are not provided in the connected documents. Monitor for updates from official sources.
CVE-2019-1261
Microsoft SharePoint vulnerable to a spoofing/CSRF issue in which improper handling of requests to authorize applications can allow an attacker to perform cross-site requests. CVE-2019-1261 is the associated entry, distinct from CVE-2019-1259. Connected documents also reference related SharePoint...
CVE-2022-21987
CVE-2022-21987 is a Spoofing vulnerability in Microsoft SharePoint Server affecting multiple editions (2013/2016/2019 Subscription Edition). The connected documents confirm the issue allows spoofing content presented to users, potentially deceiving them into believing a site is legitimate. Micros...
CVE-2020-1177
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2020-1460
CVE-2020-1460 is a Microsoft SharePoint Server Remote Code Execution vulnerability. The issue occurs when SharePoint Server fails to properly identify and filter unsafe ASP.Net web controls; an authenticated attacker can craft and invoke a malicious page to execute actions in the SharePoint appli...
CVE-2020-16944
CVE-2020-16944 describes a cross-site scripting (XSS) vulnerability in SharePoint Server caused by improper sanitization of specially crafted requests. An authenticated attacker could lure a user to click a crafted URL (via email, instant messenger, or a compromised site) and execute scripts in t...
CVE-2020-0795
CVE-2020-0795 concerns Microsoft SharePoint Reflective Cross-Site Scripting. The vulnerability arises when SharePoint Server fails to properly sanitize a specially crafted request, allowing an authenticated attacker to exploit an XSS condition. It is distinct from CVE-2020-0891. Connected sources...
CVE-2021-38652
CVE-2021-38652 is a Microsoft SharePoint Server spoofing vulnerability affecting on-premises SharePoint components. Public CVSS3.1 metrics from NVD show a base score of 3.5 (LOW) with network exposure, low attack complexity, low privileges required, and user interaction required; confidentiality ...