CVE-2023-28288

CVE-2023-28288 is a network-exploitable spoofing vulnerability affecting Microsoft SharePoint Server families. Public references (Exploit-DB entry) show a remote exploit against SharePoint Enterprise Server 2016, aligning with the vulnerability class described as spoofing in the CVE record. The C...

CVE-2024-21318

CVE-2024-21318 affects Microsoft SharePoint Server and is described as a remote code execution vulnerability. The CVE entry lists a CVSS v3.1 base score of 8.8 ( HIGH ) with network attack vector, low attack complexity, and privileges required as LOW, no user interaction, and impact on confidenti...

CVE-2019-1201

CVE-2019-1201 affects Microsoft Word; it is a remote code execution in Word’s memory handling when processing crafted files. Exploitation requires a user to open a specially crafted Word document, with attack vectors including email attachments (or previews in Outlook) and web-hosted files. The v...

CVE-2020-16929

CVE-2020-16929 (Microsoft Excel RCE) is a remote code execution vulnerability caused by improper handling of in-memory objects. Successful exploitation requires a user to open a specially crafted Excel file, via email or web-hosted lure. If the user runs with administrative rights, an attacker co...

CVE-2020-1446

The CVE-2020-1446 entry describes a remote code execution vulnerability in Microsoft Word arising from improper handling of memory objects. The vulnerability affects Microsoft Word and allows an attacker to craft a file that, when opened by a user, could execute actions in the security context of...

CVE-2023-23395

CVE-2023-23395 relates to a spoofing vulnerability in Microsoft SharePoint Server. The connected sources confirm: (1) affected product is SharePoint Server; (2) root cause described as spoofing in SharePoint components; (3) CVSSv3.1 base score of 3.1 (LOW) with network attack vector, high complex...

CVE-2021-28474

CVE-2021-28474 maps to a Microsoft SharePoint Server remote code execution vulnerability. Public details within the provided docs are limited to high‑level descriptions (SharePoint Server RCE) and CVSS metrics; no explicit exploit vectors or affected versions are stated in Connected documents. Th...

CVE-2022-21840

CVE-2022-21840 is a Microsoft Office remote code execution vulnerability. Public documentation notes an Office RCE that can be exploited via social engineering (e.g., opening a malicious attachment or visiting a malicious site) and may require user interaction. The CVSS details indicate high impa...

CVE-2013-0007

CVE-2013-0007 impacts Microsoft XML Core Services (MSXML) versions 4.0–6.0. A parsing fault in MSXML can allow remote code execution when a user visits a crafted web page (MSXML XSLT vulnerability). Affected components include MSXML DLLs; root cause is improper XML content parsing. Mitigation is ...

CVE-2023-24950

CVE-2023-24950 is a Microsoft SharePoint Server spoofing vulnerability. Public docs identify affected platforms as SharePoint Server (2016/2019 and Subscription Edition) and describe the root cause as a spoofing flaw in the server, enabling spoofing attacks. The connected Nessus entries tie this ...

CVE-2018-8378

CVE-2018-8378 describes an information disclosure in Microsoft Office when Office reads out-of-bounds memory due to an uninitialized variable, potentially exposing memory contents. Affected components include Word, SharePoint Server, Word/Excel Viewers, and related Office products. Connected Open...

CVE-2021-36940

CVE-2021-36940 is a Microsoft SharePoint Server spoofing vulnerability. Public details in connected docs identify affected products as SharePoint Server 2013, 2019, and related server components; root cause involves spoofing access to resources. Remediation is provided via security updates: KB401...

CVE-2020-0927

Technical details about CVE-2020-0927 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

CVE-2021-40487

Technical details about CVE-2021-40487 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2022-24472

CVE-2022-24472 is a Microsoft SharePoint Server spoofing vulnerability. Connected sources confirm affected product family (SharePoint Server variants) and indicate remediation via security updates KB5002191 (SharePoint Server Subscription Edition) and KB5002180 (SharePoint Server 2019), which add...

CVE-2023-33165

CVE-2023-33165 affects Microsoft SharePoint Server (SharePoint Server 2019 Update). The connected documents identify a security feature bypass vulnerability in SharePoint Server that can bypass security restrictions. Remediation is provided via security update KB5002423 (build 16.0.10400.20008) f...

CVE-2026-62826

CVE-2026-62826 affects Microsoft SharePoint Server where improper neutralization of input during web page generation enables an authorized attacker to spoof over a network. The NVD entry (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base score 4.6) confirms cross-site scripting vulnerability wi...

CVE-2020-1102

CVE-2020-1102 is a remote code execution vulnerability in Microsoft SharePoint where the product fails to check the source markup of an application package. Connected Nessus entries indicate affected suites include: Microsoft SharePoint Server 2016 < 16.0.5005.1000 (multiple vulnerabilities in...

CVE-2026-45456

CVE-2026-45456 affects Microsoft Office apps (notably Outlook and Word) and is caused by a resource access type confusion that can lead to local code execution. The vulnerability allows an authenticated, local attacker to run arbitrary code without user interaction, with high impact on confidenti...

CVE-2011-0653

CVE-2011-0653 is an XSS vulnerability in Microsoft Office SharePoint Server 2010 (Gold and SP1) and SharePoint Foundation 2010. The root cause is insufficient validation of input in the shared calendar object, allowing a remote attacker to entice a user to a crafted page and inject arbitrary web ...

CVE-2021-34467

CVE-2021-34467 affects Microsoft SharePoint Server (SharePoint Server 2019). The connected documents indicate this is a remote code execution vulnerability addressed by the security update KB5001975, which resolves both the RCE and a spoofing issue. The patch is for 64-bit SharePoint Server 2019 ...

CVE-2021-34520

CVE-2021-34520 concerns a Microsoft SharePoint Server Remote Code Execution vulnerability. The related connected document KB5001975 confirms a security update for SharePoint Server 2019 (16.0.10376.20001) that addresses this vulnerability. The CVE is described with high severity in accompanying m...

CVE-2021-24104

CVE-2021-24104 is a spoofing vulnerability in Microsoft SharePoint Server reported across multiple SharePoint releases (2013, 2016, 2019, and related Server deployments). The connected Nessus/NVD entries corroborate that this issue is part of a set of March 2021 security updates and is addressed ...

CVE-2021-28453

CVE-2021-28453 is a Microsoft Word remote code execution vulnerability. The primary sources (NVD entry for CVE-2021-28453) and connected Nessus plugins reference Word/Office products being affected by a remote code execution vulnerability tied to this CVE. Some Nessus entries list Word/Office as ...

CVE-2021-34468

CVE-2021-34468 is a Microsoft SharePoint Server Remote Code Execution vulnerability. The initial data indicates an RCE weakness affecting SharePoint Server with a CVSS v3.1 base score of 8.0 (HIGH), an adjacent network attack vector, low attack complexity, no privileges required, and user interac...

CVE-2016-0025

CVE-2016-0025 is a memory corruption vulnerability in Microsoft Office products that allows remote code execution via a crafted Office document. Affected software includes Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Wo...

CVE-2012-1863

CVE-2012-1863 is an XSS in Microsoft SharePoint: SharePoint Server 2007 SP2/SP3, WSS 3.0 SP2, and SharePoint Foundation 2010 Gold/SP1 allow remote attackers to inject arbitrary scripts via crafted JavaScript in a URL due to insufficient sanitization of the List parameter. The vulnerability is add...

CVE-2013-1330

CVE-2013-1330 is described as a vulnerability in Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3, SharePoint Server 2010 SP1/SP2, and Office Web Apps 2010 where the EnableViewStateMac attribute is not enabled by default. This permits remote code execution via an unassigned...

CVE-2020-16945

CVE-2020-16945 concerns a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where specially crafted web requests are not properly sanitized. An authenticated attacker could send such a request and, if successful, execute scripts in the security context of the current user. T...

CVE-2021-26420

CVE-2021-26420 is a Microsoft SharePoint Server Remote Code Execution vulnerability. Connected documents show a Microsoft security update KB5001944 that fixes this issue for SharePoint Server 2019 (64‑bit) and replaces prior updates. The update description confirms the vulnerability involves remo...

CVE-2020-17118

CVE-2020-17118 is a remote code execution vulnerability in Microsoft SharePoint Server. The connected documents confirm it affects multiple SharePoint Server versions (2010, 2013, 2016, 2019) and that systems missing security updates are affected. No explicit root-cause details are provided in th...

CVE-2024-26251

CVE-2024-26251 refers to a Microsoft SharePoint Server spoofing vulnerability that allows an attacker to impersonate another user when a victim follows a rogue link. Connected sources confirm exploitation depends on social/drive-by user interaction, with root cause in improper spoofing/auth conte...

CVE-2012-1859

CVE-2012-1859 is a cross-site scripting (XSS) vulnerability in SharePoint components: scriptresx.ashx affects SharePoint Server 2010 (Gold/SP1) and Foundation 2010 (Gold/SP1), as well as Office Web Apps 2010. The issue allows remote attackers to inject arbitrary JavaScript/HTML by crafting elemen...

CVE-2023-21744

CVE-2023-21744 is a Microsoft SharePoint Server remote code execution vulnerability. Connected sources confirm that it affects SharePoint Server products (Foundation 2013, Server 2016/2019 and subscriptions) and that exploitation leads to arbitrary code execution with network access and no user i...

CVE-2021-27076

CVE-2021-27076 is a SharePoint Server Remote Code Execution flaw rooted in InfoPath session state deserialization. The vulnerability arises when the server deserializes a crafted DocumentSessionState via the BinaryFormatter, enabling arbitrary code execution with SYSTEM privileges after deseriali...

CVE-2021-31966

CVE-2021-31966 is a Microsoft SharePoint Server remote code execution vulnerability. The connected documents confirm affected product families include SharePoint Server (2013/2016/2019 on-premises) and show that patches released June 8, 2021 (KB5001922/KB5001946, and related advisories) address t...

CVE-2013-1315

CVE-2013-1315 is a remote code execution/memory corruption vulnerability affecting Microsoft Office components. The public records identify affected products as Microsoft SharePoint Server 2007 SP3, 2010 SP1/SP2, 2013; Office Web Apps 2010; Excel 2003 SP3/2007 SP3/2010 SP1/SP2/2013/2013 RT; Offic...

CVE-2013-3848

CVE-2013-3848 affects Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer, allowing remote code execution or memory corruption via a crafted Off...

CVE-2020-1148

Technical details for CVE-2020-1148 are not publicly available in the provided documents. Connected sources reference SharePoint spoofing vulnerabilities in general, but do not map concrete affected versions, root cause, or fixes. Monitor for updates.

CVE-2021-26418

Microsoft SharePoint Server 2019 is affected by CVE-2021-26418 (Spoofing). The vulnerability is addressed by the May 11, 2021 security update KB5001916, which resolves the spoofing issue alongside related fixes. The update fixes remote-code-execution/spoofing concerns and requires installing KB50...

CVE-2021-1715

CVE-2021-1715 is a Microsoft Word Remote Code Execution vulnerability. The CVE is referenced in several January 2021 security-update advisories (Word/Office products) and appears in Nessus plugins cataloging Word and Office patches alongside related CVEs (e.g., CVE-2021-1716). The connected docum...

CVE-2007-2581

CVE-2007-2581 affects Microsoft Windows SharePoint Services 3.0 (Windows Server 2003) and Office SharePoint Server 2007. The vulnerability is a cross-site scripting (XSS) flaw caused by lack of input validation when processing URL requests (PATH_INFO) in SharePoint pages (notably default.aspx). S...

CVE-2020-1198

CVE-2020-1198 is a Microsoft SharePoint Server XSS vulnerability where a crafted request to an affected SharePoint server is not properly sanitized. An authenticated attacker could execute scripts in the user’s browser, access data they aren’t authorized to read, and perform actions in the user’s...

CVE-2020-17121

No concrete technical details for CVE-2020-17121 are present in the provided connected documents; they only reference it among December 2020 SharePoint updates without specifics on affected components or root cause.

CVE-2021-34519

CVE-2021-34519 is a Microsoft SharePoint Server information disclosure vulnerability affecting on‑premises SharePoint Server variants. Connected documents confirm it is an information disclosure issue tied to SharePoint Server (2013/2016/Enterprise Server 2016) and reference security updates (e.g...

CVE-2024-38018

CVE-2024-38018 affects Microsoft SharePoint Server and is described as a remote code execution vulnerability. Connected sources indicate the issue arises from improper handling of serialized instances of the SPThemes class, enabling an attacker to execute arbitrary code on the target system. Repo...

CVE-2017-8509

CVE-2017-8509 is an Office remote code execution vulnerability that arises when Office components mishandle objects in memory, allowing an attacker to take control of an affected system if a user opens a crafted Office file. Public details in connected documents indicate the vulnerability affects...

CVE-2020-0850

CVE-2020-0850 is a Microsoft Word remote code execution vulnerability. The issue arises when Word fails to correctly handle objects in memory, enabling an attacker to craft a file that, when opened by a user, could execute code in the current user’s security context. Exploitation would require th...

CVE-2020-17122

CVE-2020-17122 is a Microsoft Excel remote code execution vulnerability. The public details in the supplied documents identify Excel (Office component) as affected, with the vulnerability categorized as a remote code execution issue in multiple Office deployments. The NVD entry notes a CVSSv3.1 b...

CVE-2013-0084

CVE-2013-0084 affects Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1. The vulnerability arises from insufficient sanitization of user-supplied URLs, enabling a directory traversal that can bypass content-read restrictions and, per multiple advisories, may allow an attacke...