CVE-2025-21344

CVE-2025-21344 is a Microsoft SharePoint Server remote code execution vulnerability affecting on-premises SharePoint Server products. Connected sources confirm the issue as a remote code execution flaw impacting SharePoint Server installations (2016, Subscription Edition, 2019) and indicate Micro...

CVE-2026-66805

A CVE-2026-66805 entry exists with conflicting descriptions across sources. The connected Red Hat CVE details describe a flaw in the console component of a managed-cluster hub: an attacker who can write to container logs can inject malicious code into the hub console user’s browser session by vie...

CVE-2011-1892

CVE-2011-1892 targets SharePoint-related products (SharePoint Server/Workspace/ Groove components, Office Web Apps, Windows SharePoint Services, etc.). The flaw is an XXE-style vulnerability where Web Parts containing XML classes referencing external entities allow remote authenticated users to r...

CVE-2012-0144

CVE-2012-0144 is an XSS vulnerability in themeweb.aspx affecting Microsoft SharePoint products: SharePoint Server 2010 Gold/SP1 and SharePoint Foundation 2010 Gold/SP1. The issue allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL. OpenVAS/Nessus entri...

CVE-2020-1501

CVE-2020-1501 is a Microsoft SharePoint Server spoofing vulnerability where a specially crafted web request is not properly sanitized, enabling an authenticated attacker to perform cross‑site scripting and execute actions in the user’s security context. The impact described in the sources include...

CVE-2018-0789

CVE-2018-0789 affects Microsoft SharePoint Foundation 2010, and SharePoint Server 2013/2016. It is an elevation-of-privilege vulnerability caused by how web requests are handled, enabling an attacker to escalate privileges via network access with low complexity and no user interaction. The connec...

CVE-2019-1260

CVE-2019-1260 is an elevation-of-privilege vulnerability in Microsoft SharePoint. The vulnerability is described as allowing an attacker to impersonate a user or gain higher privileges via vulnerable SharePoint components. Public references in connected documents indicate affected SharePoint Serv...

CVE-2023-36890

CVE-2023-36890 affects Microsoft SharePoint Server (2019 and Subscription Edition). The connected documents confirm a SharePoint Server information disclosure vulnerability that can lead to sensitive data exposure, with impact limited to confidentiality (CVE-2023-36890). The root cause is describ...

CVE-2020-0954

Technical details for CVE-2020-0954 are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2021-31171

Technical details about CVE-2021-31171 are not publicly provided in the supplied documents; monitor for updates.

CVE-2024-38024

A remote code execution vulnerability exists in Microsoft SharePoint Server due to deficiencies in the deserialization mechanism . This flaw allows an attacker to execute arbitrary code by loading a specially crafted file remotely. An authenticated attacker with Site Owner permissions can exploit...

CVE-2021-31948

CVE-2021-31948 technical details are not publicly provided in the supplied documents. Monitor for updates.

CVE-2022-21987

CVE-2022-21987 is a Spoofing vulnerability in Microsoft SharePoint Server affecting multiple editions (2013/2016/2019 Subscription Edition). The connected documents confirm the issue allows spoofing content presented to users, potentially deceiving them into believing a site is legitimate. Micros...

CVE-2023-33134

CVE-2023-33134 is a Microsoft SharePoint Server Remote Code Execution vulnerability affecting on‑prem SharePoint deployments. CVSS v3.1: 8.8 (Network, Privileges Needed: Low, User Interaction: None; Impact: Confidentiality, Integrity, Availability). Mitigation/Remediation: Microsoft published upd...

CVE-2015-2555

The CVE-2015-2555 entry describes a use-after-free in Microsoft Excel (2010 SP2, 2013 SP1, 2013 RT SP1, 2016, plus Excel for Mac 2011/2016 and Excel Services on SharePoint Server 2010 SP2/2013 SP1) triggered by a crafted calculatedColumnFormula object in an Office document, allowing remote code e...

CVE-2021-31964

CVE-2021-31964 is a Microsoft SharePoint Server Spoofing Vulnerability. Public entries confirm it affects on‑premises SharePoint Server; the MSRC advisory lists remediation via security update KB5001944 (June 8, 2021) for SharePoint Server 2019 and related platforms, addressing a spoofing/remote‑...

CVE-2022-35823

The connected KB describes Security Update KB5002271 for SharePoint Server Subscription Edition (Sept 13, 2022) addressing remote code execution vulnerabilities including CVE-2022-35823. It notes this update resolves multiple RCE issues, requires the base SharePoint Server Subscription Edition re...

CVE-2017-8742

Two CVEs (CVE-2017-8742 and CVE-2017-8743) describe remote code execution in Microsoft PowerPoint family and associated server/web apps due to improper handling of objects in memory. CVE-2017-8742 affects PowerPoint up to 2016, PowerPoint Viewer 2007, SharePoint Server 2013 SP1, SharePoint Enterp...

CVE-2020-16944

CVE-2020-16944 describes a cross-site scripting (XSS) vulnerability in SharePoint Server caused by improper sanitization of specially crafted requests. An authenticated attacker could lure a user to click a crafted URL (via email, instant messenger, or a compromised site) and execute scripts in t...

CVE-2021-40482

Public technical details (affected product/version/root cause/fix) for CVE-2021-40482 are not provided in the supplied documents; monitor for updates.

CVE-2019-1261

Microsoft SharePoint vulnerable to a spoofing/CSRF issue in which improper handling of requests to authorize applications can allow an attacker to perform cross-site requests. CVE-2019-1261 is the associated entry, distinct from CVE-2019-1259. Connected documents also reference related SharePoint...

CVE-2020-1502

CVE-2020-1502 is an information-disclosure vulnerability in Microsoft Word where memory contents can be exposed due to how Word handles objects in memory. An attacker could lure a user to open a specially crafted document, potentially revealing memory contents needed to compromise data. The explo...

CVE-2022-41062

CVE-2022-41062 is a Microsoft SharePoint Server remote code execution vulnerability. Public details shown in connected docs indicate it affects multiple SharePoint products (Foundation 2013, Server 2016/2019, Subscription Edition) and is exploitable via remote attack with high impact (CVSS 3.1: 8...

CVE-2022-44693

CVE-2022-44693 is a Microsoft SharePoint Server remote code execution vulnerability. Connected sources confirm impact on SharePoint Server components and indicate remediation via security updates: KB5002321 (SharePoint Server 2016) addresses the vulnerability with a 16.0.5374.1000 build in the up...

CVE-2019-1203

The CVE-2019-1203 entry refers to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by insufficient sanitization of crafted web requests. An authenticated attacker could exploit this to run scripts in the user’s browser, access restricted content, perform actions on...

CVE-2014-0251

CVE-2014-0251 affects Microsoft SharePoint products including Windows SharePoint Services 3.0 SP3, SharePoint Server 2007 SP3, 2010 SP1/SP2, 2013 Gold/SP1, SharePoint Foundation 2010 SP1/SP2/2013 Gold/SP1, Project Server 2010 SP1/SP2/2013 Gold/SP1, Web Applications 2010 SP1/SP2, Office Web Apps S...

CVE-2019-0949

CVE-2019-0949 is a spoofing vulnerability in Microsoft SharePoint Server arising from improper sanitization of specially crafted web requests. Connected sources confirm this vulnerability family and link it to SharePoint Server, including a Nessus entry for SharePoint Server 2019 (builds

CVE-2021-24072

CVE-2021-24072 is a Microsoft SharePoint Server remote code execution vulnerability. The entry shows a CVSSv3.1 base score of 8.8 (HIGH) with network access, low complexity, privileges required: Low, and no user interaction. It affects confidentiality, integrity, and availability (all HIGH). Conn...

CVE-2025-47163

CVE-2025-47163 is a Microsoft SharePoint/SharePoint Server remote code execution vulnerability described as a deserialization of untrusted data that could allow an authorized attacker to execute code over a network. The CVE is documented across multiple sources (Microsoft MSRC advisories and CVE ...

CVE-2026-40365

CVE-2026-40365 : Microsoft SharePoint Server remote code execution due to insufficient granularity of access control. An authorized attacker can execute code over a network (CVSS v3.1: 8.8, HIGH; AV:N/AC:L/PR:L/UI:N/S:U). Public docs confirm the issue and that Microsoft released security updates ...

CVE-2020-1177

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2020-1335

CVE-2020-1335 is a Microsoft Excel remote code execution vulnerability caused by improper handling of memory objects. An attacker could run arbitrary code in the user’s context, potentially taking full control if the user has admin rights. Exploitation requires the user to open a specially crafte...

CVE-2020-1447

CVE-2020-1447 is a Microsoft Word remote code execution vulnerability tied to how Word handles objects in memory. Connected sources corroborate that it affects Word and can allow an attacker to run code in the context of the current user when a specially crafted file is opened or processed. The N...

CVE-2022-38053

CVE-2022-38053 is a Microsoft SharePoint Server remote code execution vulnerability. According to the NCSC advisory, the issue affects Microsoft SharePoint (Office/SharePoint) and can lead to execution of arbitrary code with high impact (CVSS v3.1: 8.8, Network access, Low attack complexity, Priv...

CVE-2025-49703

CVE-2025-49703 is a Microsoft Word/Office remote code execution vulnerability caused by a use-after-free condition in Word. Affected products include Word/Office; exploitation yields local code execution with High impact per the CVSS (Local access, user interaction required, high confidentiality/...

CVE-2026-55134

CVE-2026-55134 is a stack-based buffer overflow in Microsoft Word (Office) that can allow a local attacker to execute arbitrary code. The CVE entry is corroborated by multiple sources in the Connected documents, which identify Word as the affected component and describe local code execution as th...

CVE-2019-0561

CVE-2019-0561 is an information-disclosure vulnerability in Microsoft Word/Office related to improper handling of Word fields, specifically via Word macro buttons. The issue allows reading arbitrary files from the targeted system. Multiple Nessus/OpenVAS entries and advisories group CVE-2019-0561...

CVE-2019-1034

CVE-2019-1034 affects Microsoft Word/Office where in-memory handling of objects can be exploited to run remote code after a user opens a crafted file. Exploitation relies on social/vector delivery (email or web), with the attacker gaining the same rights as the logged-on user. The vulnerability i...

CVE-2020-0926

Technical details for CVE-2020-0926 are not publicly available in the provided documents. Monitor for updates from official sources to confirm affected products, vectors, and mitigations.

CVE-2020-1338

Microsoft Word Remote Code Execution (CVE-2020-1338): A vulnerability exists where Word mishandles in-memory objects, enabling an attacker to execute arbitrary code via a specially crafted Word file. Exploitation requires the current user to open the crafted file (e.g., via email or a compromised...

CVE-2020-1450

CVE-2020-1450 is an XSS vulnerability affecting Microsoft SharePoint Server. The issue arises from improper sanitization of crafted web requests to the SharePoint server, enabling script execution in the user's context. Documented references (CNVD entries and Nessus plugin notes) corroborate Cros...

CVE-2020-17061

CVE-2020-17061 is a Microsoft SharePoint Remote Code Execution vulnerability. CVSS v3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affects SharePoint Server across multiple versions (e.g., 2010/2013/2016/2019) as indicated by Nessus plugins, and is addressed by Micros...

CVE-2016-0022

CVE-2016-0022 corresponds to a memory corruption vulnerability in Microsoft Office components (Word and related Word/Office Suite on Windows and Mac) that could allow remote code execution via a crafted Office document. Connected sources indicate this is tied to MS16-015 and affects Word 2007 SP3...

CVE-2017-0195

CVE-2017-0195 affects Microsoft SharePoint/Office Web Apps stack (e.g., SharePoint Server, Excel Services, Excel Web Apps, Office Web Apps Server, Office Online Server). The vulnerability enables remote attackers to perform cross-site scripting and to run script with local user privileges via a c...

CVE-2019-1134

CVE-2019-1134 corresponds to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server arising when a specially crafted web request is not properly sanitized. The provided connected documents consistently describe this XSS issue in SharePoint Server without detailing affected vers...

CVE-2020-1499

CVE-2020-1499 is a spoofing vulnerability in Microsoft SharePoint Server where specially crafted web requests are not properly sanitized. An authenticated attacker could exploit it to perform cross-site scripting (XSS) and to run scripts in the user’s security context, potentially reading restric...

CVE-2021-38651

CVE-2021-38651 is a Microsoft SharePoint Server spoofing vulnerability. Connected sources confirm affected product: SharePoint Server, and root cause involves spoofing capabilities likely allowing an attacker to impersonate legitimate users/services over the network. The CVE’s published metrics f...

CVE-2025-47168

CVE-2025-47168 (Microsoft Word RCE) is a use-after-free vulnerability in Word that allows an attacker to execute code locally after triggering with a crafted file or object. The issue is in Word component handling, leading to arbitrary code execution with the attacker’s privileges; the CVSS detai...

CVE-2026-47294

CVE-2026-47294 describes a SharePoint Server remote code execution via deserialization of untrusted data in Microsoft Office SharePoint. The vulnerability allows an authenticated, network-connected attacker to potentially run code on the affected server. The linked Microsoft advisories indicate t...

CVE-2016-3234

CVE-2016-3234 affects Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint 2010 SP2/2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1. The root cause is an information disclosure flaw that...