CVE-2020-1200

CVE-2020-1200 is a Microsoft SharePoint remote code execution vulnerability. It arises when SharePoint fails to properly check the source markup of an uploaded application package, allowing an attacker to execute arbitrary code within the SharePoint application pool context after a user uploads a...

CVE-2020-1452

CVE-2020-1452 — SharePoint RCE : A remote code execution vulnerability where SharePoint fails to validate the source markup of application packages. Exploitation requires a user-uploaded, specially crafted SharePoint app package, allowing arbitrary code execution in the SharePoint application poo...

CVE-2021-42294

CVE-2021-42294 is a Microsoft SharePoint Server remote code execution vulnerability. Affected products include SharePoint Server 2013/2016/2019 (including Subscription Edition). Public remediation exists via December 2021 security updates (e.g., KB5002054 for SharePoint Server 2019; associated MS...

CVE-2022-30159

CVE-2022-30159 is identified as a Microsoft Office information disclosure vulnerability referenced by security updates KB5002062/KB5002222/KB5002224. The connected documents indicate affected ecosystems include SharePoint Server and Microsoft Office components, with remediation via the listed sec...

CVE-2024-49065

Technical details about CVE-2024-49065 are not public in the provided documents; no affected product versions, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2025-47163

CVE-2025-47163 is a Microsoft SharePoint/SharePoint Server remote code execution vulnerability described as a deserialization of untrusted data that could allow an authorized attacker to execute code over a network. The CVE is documented across multiple sources (Microsoft MSRC advisories and CVE ...

CVE-2017-0027

CVE-2017-0027 affects Microsoft Office products including Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1. Description: information disclosure from process memory when processing a crafted Office docume...

CVE-2020-0891

CVE-2020-0891 is a SharePoint Server cross-site scripting vulnerability (likely “Microsoft SharePoint Reflective XSS”) caused by improper sanitization of a specially crafted request. The issue is exploitable by an authenticated attacker sending crafted input to an affected SharePoint server. Conn...

CVE-2020-1454

CVE-2020-1454 corresponds to a SharePoint Reflective XSS vulnerability. Affected product: SharePoint Server. Root cause: improper sanitization of a specially crafted request, enabling an authenticated attacker to trigger cross-site scripting on the affected server. In the connected scanning resul...

CVE-2017-8501

CVE-2017-8501 is described across connected CNVD/OpenVAS entries as a memory corruption vulnerability in Microsoft Office components (notably Word/Excel/SharePoint) that can be triggered by specially crafted files to yield remote code execution or DoS under the current user. The root cause cited ...

CVE-2020-1453

CVE-2020-1453 is a remote code execution vulnerability in Microsoft SharePoint. It occurs when SharePoint fails to validate the source markup of an application package uploaded to affected SharePoint versions, allowing an attacker to execute arbitrary code in the SharePoint application pool and s...

CVE-2022-38009

The Connected KB article (KB5002271) confirms CVE-2022-38009 is part of the September 2022 security update for SharePoint Server Subscription Edition. It states this update resolves remote-code-execution vulnerabilities in SharePoint Server and requires installing the standalone security update p...

CVE-2016-0127

CVE-2016-0127 affects Microsoft Office components: Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2/2013 SP1, and Office Web Apps 2010 SP2/Server 2013 SP1. Description...

CVE-2019-1202

CVE-2019-1202 affects Microsoft SharePoint where session objects are mishandled, enabling an authenticated attacker to hijack another user’s session. The root cause is improper handling of session objects within SharePoint. A specially crafted application could be used to exploit the flaw. Remedi...

CVE-2020-0977

CVE-2020-0977 is a spoofing vulnerability in Microsoft SharePoint Server where a specially crafted web request is not properly sanitized. The available connected document (Nessus plugin for SharePoint April 2020 updates) lists CVE-2020-0977 under a spoofing family of issues, alongside other relat...

CVE-2020-1500

CVE-2020-1500 is a SharePoint vulnerability in which an authenticated user could send a specially crafted request to a SharePoint Server, causing spoofing and cross-site scripting (XSS) in the user’s browser. The root cause is improper sanitization of web requests on SharePoint Server, enabling a...

CVE-2021-24071

CVE-2021-24071 is a Microsoft SharePoint Information Disclosure Vulnerability. The NVD entry lists a network-attack, low-complexity flaw with partial confidentiality impact (CVSSv2 4.0; CVSSv3.1 6.5; secrecy impact HIGH per CNA). Connected Nessus plugins describe multiple SharePoint vulnerabiliti...

CVE-2021-40484

CVE-2021-40484 is a Microsoft SharePoint Server spoofing vulnerability. Public records confirm a spoofing risk tied to SharePoint Server components, with a high-severity CVSS v3 base score from Microsoft’s advisory. The linked security update KB5002028 for SharePoint Server 2019 (and related patc...

CVE-2024-43464

CVE-2024-43464 is a Microsoft SharePoint Server remote code execution vulnerability. Affects on-premises SharePoint Server platforms; exploitation is possible remotely with network access, requiring high privileges and no user interaction, and results in full code execution with high impact (C/H/...

CVE-2025-21393

CVE-2025-21393 affects Microsoft SharePoint Server (on‑prem). The vulnerability is described as a spoofing flaw that could allow impersonation of another user, with CVSS‑3.1 base metrics: Network access, low attack complexity, privileges required Low, user interaction required, confidentiality im...

CVE-2026-66805

A CVE-2026-66805 entry exists with conflicting descriptions across sources. The connected Red Hat CVE details describe a flaw in the console component of a managed-cluster hub: an attacker who can write to container logs can inject malicious code into the hub console user’s browser session by vie...

CVE-2014-1754

CVE-2014-1754 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server 2013 (Gold/SP1), SharePoint Foundation 2013 (Gold/SP1), Office Web Apps Server 2013 (Gold/SP1), and SharePoint Server 2013 Client Components SDK. The issue allows remote attackers to inject arbitrary...

CVE-2016-3282

CVE-2016-3282 is a Microsoft Office remote code execution vulnerability arising from memory corruption in Office components (Word, Word Automation Services, SharePoint-related components, etc.). It affects a broad set of Office products across Windows and macOS (Word 2007 SP3, Office 2010 SP2, Wo...

CVE-2016-7265

CVE-2016-7265 affects Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3/2010 SP2). The vulnerability is described as an information disclosure via an out-of-boun...

CVE-2019-0958

The provided documents describe CVE-2019-0958 as an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by improper sanitization of specially crafted web requests. Affected product: SharePoint Server. Root cause: failure to sanitize web input leading to privilege escalation...

CVE-2020-0975

CVE-2020-0975 is a SharePoint Spoofing vulnerability in Microsoft SharePoint Server. The issue arises when SharePoint does not properly sanitize a specially crafted web request to the affected server, enabling spoofing under the SharePoint server context. Connected sources confirm this CVE as par...

CVE-2020-1576

CVE-2020-1576 is a remote code execution vulnerability in Microsoft SharePoint. According to the provided sources, the flaw occurs when SharePoint fails to validate the source markup of an application package uploaded to an affected SharePoint version, allowing an attacker to execute arbitrary co...

CVE-2021-27052

CVE-2021-27052 is a Microsoft SharePoint Server information disclosure vulnerability affecting SharePoint Server 2016/2019 deployments. Public references in the provided connected data indicate exploitation relates to information disclosure (confidentiality impact) with remediation via security u...

CVE-2022-38008

CVE-2022-38008 is addressed by Microsoft security update KB5002258 for SharePoint Server 2019, which fixes a remote code execution vulnerability in SharePoint. The update targets SharePoint Server 2019 (build 16.0.10390.20000) and covers CVE-2022-38008 alongside other fixes; apply/update per the ...

CVE-2026-40367

CVE-2026-40367 describes an Untrusted pointer dereference in Microsoft Word that enables local code execution. Based on the provided documents, the affected product is Microsoft Word (Office). The vulnerability allows an attacker to execute code locally without user interaction, as indicated by t...

CVE-2017-8629

CVE-2017-8629 affects Microsoft SharePoint Server 2013 SP1 and is an elevation of privilege vulnerability caused by improper sanitization of crafted web requests, enabling cross-site scripting and potential unauthorized actions in the user’s security context. Connected sources confirm the vulnera...

CVE-2019-0562

CVE-2019-0562 affects Microsoft SharePoint Server/SharePoint where a crafted web request is not properly sanitized, leading to elevation of privilege. Root cause: improper sanitization of input in SharePoint Server. Impact: privilege escalation within the affected SharePoint context; the CVSS det...

CVE-2020-0924

Technical details for CVE-2020-0924 are not publicly available in the provided documents. Monitor for updates.

CVE-2020-0925

Technical details for CVE-2020-0925 are not publicly available in the provided Connected documents. The EUVD entries mention malware unrelated to this CVE. Monitor for updates from official advisories and MSRC.

CVE-2020-1482

CVE-2020-1482 is a Microsoft SharePoint Server XSS vulnerability. An authenticated attacker can send a crafted web request to an affected SharePoint server, causing the server to execute script in the context of the current user. Impact statements from the sources indicate the attacker could read...

CVE-2020-1514

CVE-2020-1514 relates to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server. The issue arises when SharePoint does not properly sanitize a crafted web request, allowing an authenticated attacker to execute script in the user’s browser context, potentially reading restricted...

CVE-2020-1523

CVE-2020-1523 is a tampering vulnerability in Microsoft SharePoint Server related to how profile data is processed. An authenticated attacker can modify a targeted user’s profile data by sending a specially crafted request to the affected SharePoint Server. The issue is addressed by a security up...

CVE-2025-29976

CVE-2025-29976 affects Microsoft SharePoint (Office SharePoint Server/SharePoint Server) with an elevation-of-privilege vulnerability due to improper privilege management. An attacker with local access and low privileges could elevate privileges on the affected system, as indicated by the CVE act...

CVE-2019-0830

Microsoft SharePoint Server is affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of crafted web requests. The issue is documented across multiple sources (e.g., CVE-2019-0830 and related entries) and is described as XSS in SharePoint. Connected documents confirm ...

CVE-2020-1227

CVE-2020-1227 is a Microsoft SharePoint Server XSS vulnerability caused by improper sanitization of crafted web requests. An authenticated attacker can send a specially crafted request to an affected SharePoint server, enabling cross-site scripting and script execution in the user’s browser with ...

CVE-2020-1580

CVE-2020-1580 is an XSS vulnerability in Microsoft SharePoint Server where improper sanitization of crafted web requests could allow an authenticated attacker to execute scripts in the user’s browser, potentially reading restricted content, impersonating the user, and altering permissions. The vu...

CVE-2024-49070

CVE-2024-49070 is a Microsoft SharePoint remote code execution vulnerability. Public sources identify it as an RCE affecting SharePoint components and linked Office/SharePoint CVEs with a base score around 7.4 (HIGH) via CVSS 3.1, local exploit vector with no user interaction required according t...

CVE-2025-27746

CVE-2025-27746 is a Microsoft Office remote-code-execution vulnerability caused by a use-after-free in Office components, enabling a local attacker to run code on the affected host. The CVE is discussed in multiple sources (Microsoft MSRC entry), and is addressed by April 2025 Office security upd...

CVE-2010-1257

CVE-2010-1257 is described as an XSS flaw in the toStaticHTML API affecting InfoPath 2003/2007, SharePoint products, and IE8. Public docs here identify IE vulnerabilities addressed by MS10-035 (Internet Explorer cumulative security update) that resolves remote code execution/related issues. The C...

CVE-2019-1296

CVE-2019-1296 is a remote code execution vulnerability in Microsoft SharePoint. The issue arises because APIs aren’t properly protected from unsafe input data, enabling potentially arbitrary code execution in the context of the SharePoint server. Reports in connected sources confirm the vulnerabi...

CVE-2020-1106

CVE-2020-1106 corresponds to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server, where improper sanitization of a crafted web request can lead to an XSS condition on the affected server. The NVD entry notes a CVSS v3.1 base score of 6.1 (Network, Low attack complexity, User...

CVE-2010-3324

CVE-2010-3324 describes an IE8/SharePoint CSS @import-based XSS bypass. The connected MSKB MS10-035 documents a broader cumulative security update for Internet Explorer to address IE vulnerabilities (including remote code execution via crafted pages) and provides update guidance. However, the pro...

CVE-2015-6038

CVE-2015-6038 affects Microsoft Office products including Excel 2007/2010/2013/2016 (Windows and Mac) and related components, as well as Excel Services on SharePoint Server and Office viewers. The vulnerability stems from memory corruption triggered by specially crafted Office documents, enabling...

CVE-2018-8580

CVE-2018-8580 is an information-disclosure vulnerability in Microsoft SharePoint Server where certain search modes are vulnerable to a CSRF-like cross-site search attack. An attacker can induce queries as a logged-in user to infer whether documents are present in search results, without exposing ...

CVE-2020-1024

CVE-2020-1024 concerns a remote code execution in Microsoft SharePoint caused by the product failing to check the source markup of an application package. The connected Nessus plugins for SharePoint Server indicate this alongside other vulnerabilities across multiple versions (e.g., SharePoint Se...