CVE-2020-1147

CVE-2020-1147 affects the .NET Framework, SharePoint Server, and Visual Studio. The root cause is improper handling of XML input, specifically a failure to validate the source markup during deserialization, which can lead to remote code execution. The vulnerability is characterized by the ability...

CVE-2023-21716

CVE-2023-21716 corresponds to a Microsoft Word/Office remote code execution vulnerability. A heap corruption flaw resides in Word’s wwlib when parsing RTF font tables with an excessive number of fonts in the fonttbl, causing an out-of-bounds write that can lead to arbitrary code execution when a ...

CVE-2018-1028

CVE-2018-1028 is a remote code execution vulnerability in the Office graphics component that occurs when handling specially crafted embedded fonts. It affects Word, Microsoft Office, SharePoint, Excel, and SharePoint Server. Successful exploitation could allow an attacker to take control of the a...

CVE-2020-1210

CVE-2020-1210 affects Microsoft SharePoint. A remote code execution flaw arises when SharePoint fails to validate the source markup of an application package; an attacker must have a user upload a crafted SharePoint app package to an affected SharePoint version. The impact is arbitrary code execu...

CVE-2019-1006

CVE-2019-1006 corresponds to an authentication bypass vulnerability in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF) that allows signing SAML tokens with arbitrary symmetric keys. The connected Nessus entries reiterate this issue as part of Microsoft SharePoint serv...

CVE-2020-0931

CVE-2020-0931 is a remote code execution vulnerability in Microsoft SharePoint caused by the product failing to validate the source markup of an application package. The connected Nessus findings describe this as part of a set of SharePoint vulnerabilities, noting several RCEs that involve upload...

CVE-2021-40486

CVE-2021-40486 is a Microsoft Word remote code execution vulnerability. It can be triggered by viewing a specially crafted Word document, with attack vectors potentially including the Preview Pane. Microsoft released a patch (KB5002004) in Oct 2021 addressing Word RCE (Word 2016 context in the KB...

CVE-2021-40442

CVE-2021-40442 is a Microsoft Excel remote code execution vulnerability. The connected Nessus/NVIDIA sources reiterate that Excel can be exploited to run arbitrary code (RCE) on the target, with exploitation possible via Microsoft Excel/Office components. The vulnerability is addressed by Microso...

CVE-2022-21840

CVE-2022-21840 is a Microsoft Office remote code execution vulnerability. Public documentation notes an Office RCE that can be exploited via social engineering (e.g., opening a malicious attachment or visiting a malicious site) and may require user interaction. The CVSS details indicate high impa...

CVE-2018-0797

CVE-2018-0797 affects Microsoft Word components in Office 2010/2013/2016 where remote code execution can occur through specially crafted RTF content due to memory handling. Public details show Word memory corruption vulnerability enabling code execution when opening malicious files. Microsoft rel...

CVE-2019-1201

CVE-2019-1201 affects Microsoft Word; it is a remote code execution in Word’s memory handling when processing crafted files. Exploitation requires a user to open a specially crafted Word document, with attack vectors including email attachments (or previews in Outlook) and web-hosted files. The v...

CVE-2020-16929

CVE-2020-16929 (Microsoft Excel RCE) is a remote code execution vulnerability caused by improper handling of in-memory objects. Successful exploitation requires a user to open a specially crafted Excel file, via email or web-hosted lure. If the user runs with administrative rights, an attacker co...

CVE-2020-1446

The CVE-2020-1446 entry describes a remote code execution vulnerability in Microsoft Word arising from improper handling of memory objects. The vulnerability affects Microsoft Word and allows an attacker to craft a file that, when opened by a user, could execute actions in the security context of...

CVE-2021-36940

CVE-2021-36940 is a Microsoft SharePoint Server spoofing vulnerability. Public details in connected docs identify affected products as SharePoint Server 2013, 2019, and related server components; root cause involves spoofing access to resources. Remediation is provided via security updates: KB401...

CVE-2021-40485

CVE-2021-40485 is described as a Microsoft Excel Remote Code Execution vulnerability. The provided data cites a CVSSv3.1 base score of 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, NONE privileges required, and user interaction required; impact is HIGH for confidentiality, integrit...

CVE-2021-1714

CVE-2021-1714 is an Excel remote code execution vulnerability affecting Microsoft Excel (Office). The connected sources indicate a vulnerability in Excel with a CVSS v3.1 base score of 7.8 (HIGH) and an attack vector LOCAL requiring user interaction, with confidentiality, integrity, and availabil...

CVE-2020-1148

Technical details for CVE-2020-1148 are not publicly available in the provided documents. Connected sources reference SharePoint spoofing vulnerabilities in general, but do not map concrete affected versions, root cause, or fixes. Monitor for updates.

CVE-2021-1715

CVE-2021-1715 is a Microsoft Word Remote Code Execution vulnerability. The CVE is referenced in several January 2021 security-update advisories (Word/Office products) and appears in Nessus plugins cataloging Word and Office patches alongside related CVEs (e.g., CVE-2021-1716). The connected docum...

CVE-2020-0850

CVE-2020-0850 is a Microsoft Word remote code execution vulnerability. The issue arises when Word fails to correctly handle objects in memory, enabling an attacker to craft a file that, when opened by a user, could execute code in the current user’s security context. Exploitation would require th...

CVE-2023-21717

CVE-2023-21717 affects Microsoft SharePoint Server as an Elevation of Privilege vulnerability. Connected sources confirm affected SharePoint Server family (2013/2016/2019 and Subscription/Foundation variants) with multiple references to CVE-21717 and CVE-21716; the exact root cause is not detaile...

CVE-2020-1583

CVE-2020-1583 is a Microsoft Word information-disclosure vulnerability. An attacker could craft a document to cause Word to inappropriately disclose memory contents, enabling data compromise if the memory location of created objects is known. The vulnerability is triggered by memory handling of W...

CVE-2020-0973

Technical details for CVE-2020-0973 are not publicly available in the provided documents. No specific affected product/version or remediation is listed here. Monitor for updates.

CVE-2020-1495

CVE-2020-1495 (Microsoft Excel) : A remote code execution via memory corruption in Excel occurs when the application fails to correctly handle objects in memory. An attacker who can lure a user to open a specially crafted Excel file (e.g., via email or a website) could execute arbitrary code in t...

CVE-2022-41122

CVE-2022-41122 is described in connected CNVD/NVD sources as a Microsoft SharePoint Server spoofing vulnerability. The CNVD entry notes that an attacker could exploit a specially crafted website to spoof content, tricking users into believing the site is legitimate. The available documents do not...

CVE-2022-41061

CVE-2022-41061 is a Microsoft Word remote code execution vulnerability. The CVSS v3.1 base score is 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, and user interaction required; impact is high for confidentiality, integrity, and availability. Affected: Microsoft Word / Office compon...

CVE-2022-41060

CVE-2022-41060 is a Microsoft Word information disclosure vulnerability. The connected documents reference Word/Office components affected by the November 2022 updates and Office Web Apps Server updates (e.g., KB5002261, KB5002276) addressing Word information disclosure and related vulnerabilitie...

CVE-2020-0980

CVE-2020-0980 is a Microsoft Word remote code execution vulnerability caused by improper handling of in-memory objects. It affects Word/Office when parsing crafted files; the impact is potential code execution in the current user context. In public docs, the vulnerability is addressed by the Offi...

CVE-2020-1342

CVE-2020-1342 is an information-disclosure vulnerability in Microsoft Office (notably Word/Office components) caused by reading out of bound memory due to an uninitialized variable. The detail explicitly states memory contents could be disclosed when a vulnerable file is opened in affected Office...

CVE-2020-1503

CVE-2020-1503 is an information-disclosure vulnerability in Microsoft Word where memory contents can be disclosed through a crafted Word document. The root cause is improper handling of in‑memory objects, enabling disclosure of memory contents when a user opens a malicious document. Exploitation ...

CVE-2022-37961

CVE-2022-37961 is a remote code execution vulnerability in Microsoft SharePoint Server. The Connected KB describes a security update (KB5002271) for SharePoint Server Subscription Edition (16.0.x) released around Sep 13, 2022 that resolves this RCE alongside related SharePoint RCE advisories. Aff...

CVE-2018-8284

CVE-2018-8284 is a remote code execution vulnerability in the Microsoft .NET Framework caused by improper input validation. The NVD entry lists affected runtimes across multiple versions (e.g., .NET Framework 2.0/3.0/3.5/3.5.1 and 4.x releases up to 4.7.2, including 4.6.x and 4.7.x). Microsoft MS...

CVE-2020-1218

CVE-2020-1218 – Microsoft Word Remote Code Execution : A vulnerability in Word where memory handling of in-file objects can be corrupted by a specially crafted file. An attacker could exploit this via email or a compromised website by convincing a user to open the crafted Word document, executing...

CVE-2020-1439

CVE-2020-1439 is a remote code execution vulnerability in Microsoft SharePoint’s PerformancePoint Services. The root cause, as stated in multiple sources, is that the service fails to validate the source markup of input XML, allowing an attacker to craft input that leads to code execution within ...

CVE-2020-0892

CVE-2020-0892 is a Microsoft Word remote code execution vulnerability. The linked documents confirm Word is vulnerable when it fails to properly handle objects in memory, allowing a crafted file to run code in the current user’s context. The issue is tied to multiple Word-related CVEs and is disc...

CVE-2020-0923

Technical details for CVE-2020-0923 are not publicly provided in the supplied documents; no product/version/exploit data is available. Monitor for updates.

CVE-2020-1107

Technical details about CVE-2020-1107 are not publicly available in the provided connected documents. Monitor for updates from authoritative sources for affected products, impact, and fixes.

CVE-2020-1224

CVE-2020-1224 describes an information-disclosure vulnerability in Microsoft Excel where memory contents could be improperly disclosed. The issue arises when Excel handles objects in memory, allowing an attacker to craft a document that, if opened by a user, could reveal memory contents and poten...

CVE-2022-41103

CVE-2022-41103 is Microsoft Word Information Disclosure Vulnerability. Connected sources indicate it is referenced alongside Word/Office and SharePoint update bundles (e.g., Word C2R and SharePoint November 2022 patches). The vulnerability is described as information disclosure; no explicit root-...

CVE-2021-1716

CVE-2021-1716 is a Microsoft Word Remote Code Execution vulnerability. The initial entry confirms a Word-related RCE with CVSS v3.1 base score 7.8 (HIGH) and local attack vector, with user interaction required. Connected sources (Nessus/Office/SharePoint plugin data) reference CVE-2021-1716 as pa...

CVE-2018-0789

CVE-2018-0789 affects Microsoft SharePoint Foundation 2010, and SharePoint Server 2013/2016. It is an elevation-of-privilege vulnerability caused by how web requests are handled, enabling an attacker to escalate privileges via network access with low complexity and no user interaction. The connec...

CVE-2020-0930

Technical details (affected products, versions, vulnerability root cause, impact, and remediation) are not provided in the connected documents. Monitor for updates from official sources.

CVE-2020-1460

CVE-2020-1460 is a Microsoft SharePoint Server Remote Code Execution vulnerability. The issue occurs when SharePoint Server fails to properly identify and filter unsafe ASP.Net web controls; an authenticated attacker can craft and invoke a malicious page to execute actions in the SharePoint appli...

CVE-2019-1203

The CVE-2019-1203 entry refers to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by insufficient sanitization of crafted web requests. An authenticated attacker could exploit this to run scripts in the user’s browser, access restricted content, perform actions on...

CVE-2020-1447

CVE-2020-1447 is a Microsoft Word remote code execution vulnerability tied to how Word handles objects in memory. Connected sources corroborate that it affects Word and can allow an attacker to run code in the context of the current user when a specially crafted file is opened or processed. The N...

CVE-2022-38053

CVE-2022-38053 is a Microsoft SharePoint Server remote code execution vulnerability. According to the NCSC advisory, the issue affects Microsoft SharePoint (Office/SharePoint) and can lead to execution of arbitrary code with high impact (CVSS v3.1: 8.8, Network access, Low attack complexity, Priv...

CVE-2019-1034

CVE-2019-1034 affects Microsoft Word/Office where in-memory handling of objects can be exploited to run remote code after a user opens a crafted file. Exploitation relies on social/vector delivery (email or web), with the attacker gaining the same rights as the logged-on user. The vulnerability i...

CVE-2022-44693

CVE-2022-44693 is a Microsoft SharePoint Server remote code execution vulnerability. Connected sources confirm impact on SharePoint Server components and indicate remediation via security updates: KB5002321 (SharePoint Server 2016) addresses the vulnerability with a 16.0.5374.1000 build in the up...

CVE-2020-0926

Technical details for CVE-2020-0926 are not publicly available in the provided documents. Monitor for updates from official sources to confirm affected products, vectors, and mitigations.

CVE-2022-35823

The connected KB describes Security Update KB5002271 for SharePoint Server Subscription Edition (Sept 13, 2022) addressing remote code execution vulnerabilities including CVE-2022-35823. It notes this update resolves multiple RCE issues, requires the base SharePoint Server Subscription Edition re...

CVE-2022-41062

CVE-2022-41062 is a Microsoft SharePoint Server remote code execution vulnerability. Public details shown in connected docs indicate it affects multiple SharePoint products (Foundation 2013, Server 2016/2019, Subscription Edition) and is exploitable via remote attack with high impact (CVSS 3.1: 8...