CVE-2022-21987

CVE-2022-21987 is a Spoofing vulnerability in Microsoft SharePoint Server affecting multiple editions (2013/2016/2019 Subscription Edition). The connected documents confirm the issue allows spoofing content presented to users, potentially deceiving them into believing a site is legitimate. Micros...

CVE-2021-31964

CVE-2021-31964 is a Microsoft SharePoint Server Spoofing Vulnerability. Public entries confirm it affects on‑premises SharePoint Server; the MSRC advisory lists remediation via security update KB5001944 (June 8, 2021) for SharePoint Server 2019 and related platforms, addressing a spoofing/remote‑...

CVE-2020-0795

CVE-2020-0795 concerns Microsoft SharePoint Reflective Cross-Site Scripting. The vulnerability arises when SharePoint Server fails to properly sanitize a specially crafted request, allowing an authenticated attacker to exploit an XSS condition. It is distinct from CVE-2020-0891. Connected sources...

CVE-2020-16944

CVE-2020-16944 describes a cross-site scripting (XSS) vulnerability in SharePoint Server caused by improper sanitization of specially crafted requests. An authenticated attacker could lure a user to click a crafted URL (via email, instant messenger, or a compromised site) and execute scripts in t...

CVE-2022-41062

CVE-2022-41062 is a Microsoft SharePoint Server remote code execution vulnerability. Public details shown in connected docs indicate it affects multiple SharePoint products (Foundation 2013, Server 2016/2019, Subscription Edition) and is exploitable via remote attack with high impact (CVSS 3.1: 8...

CVE-2022-44693

CVE-2022-44693 is a Microsoft SharePoint Server remote code execution vulnerability. Connected sources confirm impact on SharePoint Server components and indicate remediation via security updates: KB5002321 (SharePoint Server 2016) addresses the vulnerability with a 16.0.5374.1000 build in the up...

CVE-2022-35823

The connected KB describes Security Update KB5002271 for SharePoint Server Subscription Edition (Sept 13, 2022) addressing remote code execution vulnerabilities including CVE-2022-35823. It notes this update resolves multiple RCE issues, requires the base SharePoint Server Subscription Edition re...

CVE-2019-0949

CVE-2019-0949 is a spoofing vulnerability in Microsoft SharePoint Server arising from improper sanitization of specially crafted web requests. Connected sources confirm this vulnerability family and link it to SharePoint Server, including a Nessus entry for SharePoint Server 2019 (builds

CVE-2019-1261

Microsoft SharePoint vulnerable to a spoofing/CSRF issue in which improper handling of requests to authorize applications can allow an attacker to perform cross-site requests. CVE-2019-1261 is the associated entry, distinct from CVE-2019-1259. Connected documents also reference related SharePoint...

CVE-2021-24072

CVE-2021-24072 is a Microsoft SharePoint Server remote code execution vulnerability. The entry shows a CVSSv3.1 base score of 8.8 (HIGH) with network access, low complexity, privileges required: Low, and no user interaction. It affects confidentiality, integrity, and availability (all HIGH). Conn...

CVE-2020-1177

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2021-1718

CVE-2021-1718 is a Microsoft SharePoint Server Tampering vulnerability referenced across multiple sources. Connected documents identify affected software as SharePoint Server (notably older 2010 and later versions in Nessus entries) and classify the issue as tampering. The Nessus plugin for Secur...

CVE-2022-38053

CVE-2022-38053 is a Microsoft SharePoint Server remote code execution vulnerability. According to the NCSC advisory, the issue affects Microsoft SharePoint (Office/SharePoint) and can lead to execution of arbitrary code with high impact (CVSS v3.1: 8.8, Network access, Low attack complexity, Priv...

CVE-2014-0251

CVE-2014-0251 affects Microsoft SharePoint products including Windows SharePoint Services 3.0 SP3, SharePoint Server 2007 SP3, 2010 SP1/SP2, 2013 Gold/SP1, SharePoint Foundation 2010 SP1/SP2/2013 Gold/SP1, Project Server 2010 SP1/SP2/2013 Gold/SP1, Web Applications 2010 SP1/SP2, Office Web Apps S...

CVE-2020-17061

CVE-2020-17061 is a Microsoft SharePoint Remote Code Execution vulnerability. CVSS v3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects SharePoint Server across multiple versions (e.g., 2010/2013/2016/2019) as indicated by Nessus plugins, and is addressed by Micros...

CVE-2019-0778

CVE-2019-0778 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by inadequate sanitization of crafted web requests. Affected products include SharePoint Server components; remediation is the March 2019 security update (KB4462208 / MS19-4462184) addressing the vul...

CVE-2020-1499

CVE-2020-1499 is a spoofing vulnerability in Microsoft SharePoint Server where specially crafted web requests are not properly sanitized. An authenticated attacker could exploit it to perform cross-site scripting (XSS) and to run scripts in the user’s security context, potentially reading restric...

CVE-2021-38651

CVE-2021-38651 is a Microsoft SharePoint Server spoofing vulnerability. Connected sources confirm affected product: SharePoint Server, and root cause involves spoofing capabilities likely allowing an attacker to impersonate legitimate users/services over the network. The CVE’s published metrics f...

CVE-2020-1345

CVE-2020-1345 corresponds to a Microsoft SharePoint Server XSS vulnerability. The issue arises when SharePoint Server fails to sanitize certain crafted web requests, enabling an authenticated attacker to execute scripts in the user’s browser and potentially read restricted content, perform action...

CVE-2020-1444

CVE-2020-1444 is described across multiple connected sources as a remote code execution vulnerability in Microsoft SharePoint, triggered by parsing specially crafted email messages. The Red Hat and CNVD entries reiterate the same root cause, and Nessus-based scans list CVE-2020-1444 among several...

CVE-2021-1717

CVE-2021-1717 is a Microsoft SharePoint Server spoofing vulnerability. NVD data shows a CVSS v3.1 base score 5.4 (MEDIUM) with network access, no privileges required, but user interaction needed. Confidentiality and integrity impacts are marked as low; availability impact is none. Several Nessus/...

CVE-2019-1259

CVE-2019-1259 is a Microsoft SharePoint CSRF/spoofing vulnerability. The initial description and multiple connected entries indicate the issue arises when SharePoint improperly handles requests to authorize applications, enabling cross-site request forgery via a malicious page. The vulnerability ...

CVE-2020-1595

CVE-2020-1595 is a Microsoft SharePoint remote code execution vulnerability. The issue arises from unsafe deserialization of untrusted data by SharePoint APIs, allowing an attacker to run arbitrary code in the SharePoint application pool and farm account if they can access a susceptible API with ...

CVE-2020-17017

CVE-2020-17017 is referenced across multiple vulnerability update plugins for Microsoft SharePoint Server in the context of missing security updates released in November 2020. The connected documents indicate this CVE is part of a set of vulnerabilities affecting SharePoint Server installations (...

CVE-2020-1505

CVE-2020-1505 is an Information Disclosure vulnerability affecting Microsoft SharePoint Server where in-memory objects are mishandled. An attacker must log on to an affected system and run a specially crafted application to obtain information that could help compromise the user’s system. The issu...

CVE-2020-16942

CVE-2020-16942 is an information-disclosure vulnerability in Microsoft SharePoint Server. The issue arises when rendering specific web pages, allowing an attacker with access to the affected page to view the folder path of scripts loaded on that page due to improper disclosure of folder structure...

CVE-2020-16979

CVE-2020-16979 is an Information Disclosure Vulnerability in Microsoft SharePoint. Connected documents confirm the issue affects SharePoint Server installations and is addressed via November 2020 security updates (e.g., MS20-4486x/MS20-4487x). The exact root cause details are not disclosed in the...

CVE-2015-0085

CVE-2015-0085 is a use-after-free vulnerability in Microsoft Office components (including Office 2007/2010/2013 suites and related SharePoint/Viewer components) that enables remote code execution via a crafted Office document. The issue affects a broad set of Office applications and SharePoint-re...

CVE-2017-0255

CVE-2017-0255 affects Microsoft SharePoint Foundation 2013 SP1. The vulnerability is an elevation of privilege caused by improper sanitization of a specially crafted web request, effectively a cross-site scripting-like flaw in SharePoint handling of input. Affected component/condition: SharePoint...

CVE-2019-0831

CVE-2019-0831 is a Microsoft SharePoint Server XSS vulnerability. The connected sources indicate an XSS caused by improper sanitization of specially crafted web requests to an affected SharePoint server. The CVE-2019-0831 entry is distinct from CVE-2019-0830. No explicit exploit details, affected...

CVE-2019-1031

Microsoft SharePoint Server has an XSS vulnerability (CVE-2019-1031) due to improper sanitization of crafted web requests. An authenticated attacker could run scripts in the user’s browser, read restricted content, and perform actions on the SharePoint site (e.g., change permissions, delete conte...

CVE-2020-1100

CVE-2020-1100 is an XSS vulnerability in Microsoft SharePoint Server where improper sanitization of a specially crafted web request can lead to compromised data in affected SharePoint deployments. The vulnerability affects SharePoint Server components handling input to web requests; CVSS v3.1 vec...

CVE-2020-1573

CVE-2020-1573 is a Microsoft SharePoint Server cross-site scripting (XSS) vulnerability. The root cause is improper sanitization of crafted web requests, which an authenticated attacker could exploit to execute scripts in the user’s browser context, potentially reading restricted data, acting on ...

CVE-2020-17015

CVE-2020-17015 is a Microsoft SharePoint Server Spoofing Vulnerability. The connected sources confirm this vulnerability affects SharePoint Server in on‑premises deployments and indicate the root issue is spoofing (authentication-related) with an impact on integrity (I) and network access as the ...

CVE-2021-43242

CVE-2021-43242 is a Microsoft SharePoint Server spoofing vulnerability. Connected sources indicate the issue affects multiple SharePoint Server editions (2013/2016/2019 and SharePoint Server Subscription Edition) and is described as a session spoofing flaw that can allow an attacker to perform ac...

CVE-2019-1257

CVE-2019-1257 is a Microsoft SharePoint Remote Code Execution vulnerability where APIs fail to check the source markup of an uploaded application package. The issue is documented across multiple sources as affecting SharePoint Server (version lines cited by Nessus plugins), with the root cause be...

CVE-2019-1328

CVE-2019-1328: A spoofing vulnerability in Microsoft SharePoint Server arises from improper sanitization of specially crafted web requests. Affected product: SharePoint Server (on-premises). Root cause: insufficient sanitization leading to spoofing. Impact per available data: confidentiality impa...

CVE-2019-0670

CVE-2019-0670 is a spoofing vulnerability in Microsoft SharePoint Server caused by improper parsing of HTTP content. The affected product is SharePoint Server (various versions referenced in connected sources). The underlying issue is a failure to correctly handle specially crafted HTTP content, ...

CVE-2020-1297

Technical details for CVE-2020-1297 are not publicly available in the provided connected documents. Monitor for updates and new disclosures that specify affected products, versions, impact, and remediation.

CVE-2020-1453

CVE-2020-1453 is a remote code execution vulnerability in Microsoft SharePoint. It occurs when SharePoint fails to validate the source markup of an application package uploaded to affected SharePoint versions, allowing an attacker to execute arbitrary code in the SharePoint application pool and s...

CVE-2021-42294

CVE-2021-42294 is a Microsoft SharePoint Server remote code execution vulnerability. Affected products include SharePoint Server 2013/2016/2019 (including Subscription Edition). Public remediation exists via December 2021 security updates (e.g., KB5002054 for SharePoint Server 2019; associated MS...

CVE-2022-38009

The Connected KB article (KB5002271) confirms CVE-2022-38009 is part of the September 2022 security update for SharePoint Server Subscription Edition. It states this update resolves remote-code-execution vulnerabilities in SharePoint Server and requires installing the standalone security update p...

CVE-2018-8254

Root cause: elevation of privilege in Microsoft SharePoint Server due to improper filtering of certain web requests. Affected products include SharePoint Server and Project Server (e.g., SharePoint Enterprise Server 2016 and SharePoint Foundation 2013 SP1 per CNVD entries). CVSS metrics indicate ...

CVE-2020-1200

CVE-2020-1200 is a Microsoft SharePoint remote code execution vulnerability. It arises when SharePoint fails to properly check the source markup of an uploaded application package, allowing an attacker to execute arbitrary code within the SharePoint application pool context after a user uploads a...

CVE-2020-1205

CVE-2020-1205 affects Microsoft SharePoint Server. The vulnerability arises from improper sanitization of crafted web requests, enabling an authenticated attacker who can reach an affected SharePoint server to perform cross-site scripting and execute scripts in the user’s security context. This c...

CVE-2019-1036

CVE-2019-1036 describes a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where an attacker with authentication can exploit insufficient sanitization of crafted web requests. Successful exploitation could allow the attacker to execute scripts in the user’s browser, read co...

CVE-2020-0978

Technical details for CVE-2020-0978 are not publicly available in the provided documents; no affected products, vectors, or fixes are specified here. Monitor for official updates.

CVE-2020-1103

CVE-2020-1103 is an information-disclosure vulnerability in Microsoft SharePoint Server. The issue affects how certain search modes handle CSRF-like browser behavior: when a logged-in user visits a malicious page, the browser can issue search queries on behalf of the user. The impact, as describe...

CVE-2020-17016

CVE-2020-17016 is described in the CVE entry as a Microsoft SharePoint Server spoofing vulnerability. Connected Nessus plugins indicate that multiple SharePoint Server versions (2010, 2013, 2016, 2019) are affected and that November 2020 security updates address this issue among others; however, ...

CVE-2021-1712

CVE-2021-1712 is described in the provided documents as a Microsoft SharePoint elevation-of-privilege vulnerability. The NVD entry provides a CVSS v3.1 base score of 8.0 (NETWORK, LOW attack complexity, Privileges Required: LOW, User Interaction: REQUIRED, with HIGH confidentiality/integrity/avai...