CVE-2015-6039

CVE-2015-6039 is an XSS vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 that allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance (Security Feature Bypass). Public sources confirm th...

CVE-2020-1289

Technical details for CVE-2020-1289 are not publicly provided in the connected documents. Monitor for updates.

CVE-2019-0963

CVE-2019-0963 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by inadequate sanitization of crafted web requests. Public details in connected documents show affected products/versions: SharePoint 2016 (builds < 16.0.4849.1000) and SharePoint 2019 (builds

CVE-2013-3179

CVE-2013-3179 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server family (2007 SP3, 2010 SP1/SP2, 2013). The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. Connected OpenVAS entries corroborate MS13-067 as the related se...

CVE-2016-0011

CVE-2016-0011 affects Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1, where remote authenticated users can bypass the Access Control Policy and perform cross-site scripting (XSS) by modifying a webpart. The root cause is a security feature bypass in SharePoint that allows...

CVE-2018-8572

CVE-2018-8572 affects Microsoft SharePoint, specifically SharePoint Server and SharePoint. The vulnerability arises because the server does not properly sanitize/filter a specially crafted web request, enabling an authenticated attacker to elevate privileges on the affected SharePoint Server. Con...

CVE-2015-1653

CVE-2015-1653 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. Affected products include SharePoint Server and Foundation compon...

CVE-2016-0054

CVE-2016-0054 affects multiple Microsoft Office components (notably Excel across Windows and macOS, including Office viewers/SharePoint services). The underlying issue is memory corruption triggered by processing a crafted Office document, enabling remote code execution. Public references describ...

CVE-2018-8299

CVE-2018-8299 is an elevation-of-privilege vulnerability impacting Microsoft SharePoint Server. The issue arises when a specially crafted web request is not properly sanitized by the affected SharePoint server, allowing an attacker to escalate privileges. The CVE entry is separate from CVE-2018-8...

CVE-2012-2520

CVE-2012-2520 is a cross-site scripting vulnerability in Microsoft’s HTML sanitization component affecting multiple products (InfoPath 2007/2010, Communicator/Lync 2010, SharePoint Server/Foundation, Groove Server, Office Web Apps). The issue arises from improper input filtering in the HTML sanit...

CVE-2015-1633

CVE-2015-1633 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint components: SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1. The flaw allows remote authenticated users to inject arbitr...

CVE-2015-1636

CVE-2015-1636 is an XSS vulnerability in Microsoft SharePoint affecting SharePoint Foundation 2013 Gold/SP1 and SharePoint Server 2013 Gold/SP1. The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted request. CVSS v2 reveals a base score of 3.5 (Low) with...

CVE-2018-8155

Technical details about CVE-2018-8155 are not publicly provided in the connected documents. No affected products, versions, impact, or fixes are specified here. Monitor for official updates from vendor advisories and vulnerability feeds.

CVE-2011-1893

CVE-2011-1893 corresponds to a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint components: Office SharePoint Server 2010, Windows SharePoint Services 2.0/3.0 SP2, and SharePoint Foundation 2010. The root cause is improper handling of URI parameters, enabling remote attacke...

CVE-2013-3847

Microsoft Word Memory Corruption Vulnerability (CVE-2013-3847) affects Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer. A crafted Office document coul...

CVE-2014-2816

CVE-2014-2816 affects Microsoft SharePoint Server 2013 (Gold/SP1) and SharePoint Foundation 2013 (Gold/SP1). The vulnerability allows remote authenticated users to gain privileges via a Trojan horse app that runs a custom action in the SharePoint extensibility model (SharePoint Page Content Vulne...

CVE-2018-8252

CVE-2018-8252 affects Microsoft SharePoint Server. The connected documents describe an elevation-of-privilege flaw caused by the server not properly sanitizing or filtering specially crafted web requests, allowing a remote attacker to gain elevated privileges. The vulnerability is associated with...

CVE-2013-1289

The CVE-2013-1289 entry covers a cross-site scripting (XSS) vulnerability in multiple Microsoft HTML Sanitization components used by SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1. The issue arises from the HTML sanitization logic,...

CVE-2015-2522

CVE-2015-2522 affects Microsoft SharePoint Foundation 2013 SP1. A Cross-Site Scripting (XSS) vulnerability arises from inadequate sanitization of user-supplied content in SharePoint, allowing remote authenticated users to inject arbitrary script via crafted content. The root cause is improper san...

CVE-2016-0039

CVE-2016-0039 is an XSS vulnerability in Microsoft SharePoint Server / Foundation 2013 SP1. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request (SharePoint XSS vulnerability). Impacted components include SharePoint Server and SharePoint Foundation 2013 S...

CVE-2011-1891

CVE-2011-1891 is a Cross-site scripting (XSS) vulnerability in Microsoft SharePoint components: Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold/SP1. The issue arises from unfiltered input in a request to a script, allowing remote attackers to inject arbitrary web script o...

CVE-2015-6037

CVE-2015-6037 is an XSS vulnerability affecting Microsoft Office Web Apps/Excel Services across SharePoint Server 2010 SP2, SharePoint 2013 SP1, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1 and SharePoint Foundation 2013 SP1. The issue allows remote authenticated users to inject arbitr...

CVE-2015-1700

CVE-2015-1700 affects Microsoft SharePoint: SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 are vulnerable to remote code execution via specially crafted page content. Root cause is improper sanitization of page content, a...

CVE-2014-4116

CVE-2014-4116 is an XSS/elevation-of-privilege issue in Microsoft SharePoint Foundation 2010 SP2. The vulnerability arises from improper handling of list content, allowing remote authenticated users to inject arbitrary script/HTML via a modified list (SharePoint Elevation of Privilege Vulnerabili...

CVE-2011-1890

CVE-2011-1890 describes a Cross-Site Scripting (XSS) vulnerability in EditForm.aspx of Microsoft SharePoint Server 2010 and SharePoint Foundation 2010. The vulnerability allows a remote attacker to inject arbitrary web script or HTML via a POST, enabling XSS in affected SharePoint pages. Connecte...

CVE-2013-0085

CVE-2013-0085 describes a buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 that can be triggered by a crafted URL, leading to a denial of service via a W3WP process crash and site outage. Affected products are SharePoint Server 2010 SP1 and SharePoint Fou...