CVE-2017-0052

The CVE affects Microsoft Office components: Office Compatibility Pack SP3, Excel 2007 SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3. It is a memory corruption vulnerability exploitable via a crafted document, potentially allowing remote code execution or denial of service. ...

CVE-2017-8513

CVE-2017-8513 is a remote code execution vulnerability in Microsoft PowerPoint (Office suite) caused by improper handling of objects in memory. CVSSv3 base score 7.8 (HIGH) with local attack vector, user interaction required. MITRE/attack details are not specified in the provided documents, and e...

CVE-2020-1205

CVE-2020-1205 affects Microsoft SharePoint Server. The vulnerability arises from improper sanitization of crafted web requests, enabling an authenticated attacker who can reach an affected SharePoint server to perform cross-site scripting and execute scripts in the user’s security context. This c...

CVE-2020-1440

CVE-2020-1440 describes a tampering vulnerability in Microsoft SharePoint Server where an authenticated attacker can modify a targeted user’s profile data by sending a specially crafted request. The root cause is SharePoint’s improper handling of profile data. The impact, as stated, is the abilit...

CVE-2020-1453

CVE-2020-1453 is a remote code execution vulnerability in Microsoft SharePoint. It occurs when SharePoint fails to validate the source markup of an application package uploaded to affected SharePoint versions, allowing an attacker to execute arbitrary code in the SharePoint application pool and s...

CVE-2021-1712

CVE-2021-1712 is described in the provided documents as a Microsoft SharePoint elevation-of-privilege vulnerability. The NVD entry provides a CVSS v3.1 base score of 8.0 (NETWORK, LOW attack complexity, Privileges Required: LOW, User Interaction: REQUIRED, with HIGH confidentiality/integrity/avai...

CVE-2022-38009

The Connected KB article (KB5002271) confirms CVE-2022-38009 is part of the September 2022 security update for SharePoint Server Subscription Edition. It states this update resolves remote-code-execution vulnerabilities in SharePoint Server and requires installing the standalone security update p...

CVE-2025-59221

CVE-2025-59221 is a Microsoft Word remote code execution vulnerability caused by a use-after-free in Word. The issue affects Word components and can allow an attacker to run arbitrary code locally. Public documentation in connected sources notes multiple Office-related fixes in October 2025 secur...

CVE-2020-1200

CVE-2020-1200 is a Microsoft SharePoint remote code execution vulnerability. It arises when SharePoint fails to properly check the source markup of an uploaded application package, allowing an attacker to execute arbitrary code within the SharePoint application pool context after a user uploads a...

CVE-2022-38008

CVE-2022-38008 is addressed by Microsoft security update KB5002258 for SharePoint Server 2019, which fixes a remote code execution vulnerability in SharePoint. The update targets SharePoint Server 2019 (build 16.0.10390.20000) and covers CVE-2022-38008 alongside other fixes; apply/update per the ...

CVE-2026-55035

CVE-2026-55035 is an information-disclosure vulnerability described as an out-of-bounds read in Microsoft Office that allows a locally authenticated attacker to disclose information. Connected sources confirm this affects multiple Office components (Word, Excel, PowerPoint, SharePoint, etc.) and ...

CVE-2019-1036

CVE-2019-1036 describes a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where an attacker with authentication can exploit insufficient sanitization of crafted web requests. Successful exploitation could allow the attacker to execute scripts in the user’s browser, read co...

CVE-2020-0978

Technical details for CVE-2020-0978 are not publicly available in the provided documents; no affected products, vectors, or fixes are specified here. Monitor for official updates.

CVE-2020-1103

CVE-2020-1103 is an information-disclosure vulnerability in Microsoft SharePoint Server. The issue affects how certain search modes handle CSRF-like browser behavior: when a logged-in user visits a malicious page, the browser can issue search queries on behalf of the user. The impact, as describe...

CVE-2020-1452

CVE-2020-1452 — SharePoint RCE : A remote code execution vulnerability where SharePoint fails to validate the source markup of application packages. Exploitation requires a user-uploaded, specially crafted SharePoint app package, allowing arbitrary code execution in the SharePoint application poo...

CVE-2020-17016

CVE-2020-17016 is described in the CVE entry as a Microsoft SharePoint Server spoofing vulnerability. Connected Nessus plugins indicate that multiple SharePoint Server versions (2010, 2013, 2016, 2019) are affected and that November 2020 security updates address this issue among others; however, ...

CVE-2016-7265

CVE-2016-7265 affects Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3/2010 SP2). The vulnerability is described as an information disclosure via an out-of-boun...

CVE-2018-8504

CVE-2018-8504 is a remote code execution vulnerability in Microsoft Word (and related Office components) caused by improper handling of objects in Protected View. The issue allows code execution in the context of the currently logged-in user and is exploitable via typical Word/Office workflows; t...

CVE-2019-1202

CVE-2019-1202 affects Microsoft SharePoint where session objects are mishandled, enabling an authenticated attacker to hijack another user’s session. The root cause is improper handling of session objects within SharePoint. A specially crafted application could be used to exploit the flaw. Remedi...

CVE-2020-0891

CVE-2020-0891 is a SharePoint Server cross-site scripting vulnerability (likely “Microsoft SharePoint Reflective XSS”) caused by improper sanitization of a specially crafted request. The issue is exploitable by an authenticated attacker sending crafted input to an affected SharePoint server. Conn...

CVE-2020-0893

CVE-2020-0893 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server caused by improper sanitization of a specially crafted web request. Affected software is SharePoint Server (no explicit version range provided in the documents). The issue is documented in the NVD entry and...

CVE-2020-1069

CVE-2020-1069 is a Microsoft SharePoint Server remote code execution vulnerability described as failing to properly identify and filter unsafe ASP.NET web controls. Public documents indicate an RCE could occur when processing unsafe ASP.NET controls (and related SharePoint package handling) with ...

CVE-2020-1320

Technical details about CVE-2020-1320 are not publicly provided in the connected documents. The EUVD entries mention malware unrelated to this CVE. Monitor for official disclosures or vendor advisories for specifics.

CVE-2020-1454

CVE-2020-1454 corresponds to a SharePoint Reflective XSS vulnerability. Affected product: SharePoint Server. Root cause: improper sanitization of a specially crafted request, enabling an authenticated attacker to trigger cross-site scripting on the affected server. In the connected scanning resul...

CVE-2020-16950

CVE-2020-16950: Information disclosure in Microsoft SharePoint Server due to improper handling of in-memory objects. An attacker who can log in and run a crafted application could obtain information to further compromise the system. The vulnerability is addressed by a security update that fixes h...

CVE-2023-33159

CVE-2023-33159 is a Microsoft SharePoint Server spoofing vulnerability. Public materials confirm it affects on‑premises SharePoint Server instances and has been addressed via Microsoft security updates. The CVSS v3.1 base score is 8.8 (HIGH). Remediation is provided through July 2023 updates (e.g...

CVE-2024-43464

CVE-2024-43464 is a Microsoft SharePoint Server remote code execution vulnerability. Affects on-premises SharePoint Server platforms; exploitation is possible remotely with network access, requiring high privileges and no user interaction, and results in full code execution with high impact (C/H/...

CVE-2026-33110

CVE-2026-33110 describes a deserialization vulnerability in Microsoft SharePoint that could allow an authorized network attacker to execute code. Affected products include Microsoft SharePoint Server variants; the risk is tied to deserializing untrusted data. Remediations are provided by Microsof...

CVE-2014-1754

CVE-2014-1754 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server 2013 (Gold/SP1), SharePoint Foundation 2013 (Gold/SP1), Office Web Apps Server 2013 (Gold/SP1), and SharePoint Server 2013 Client Components SDK. The issue allows remote attackers to inject arbitrary...

CVE-2016-3282

CVE-2016-3282 is a Microsoft Office remote code execution vulnerability arising from memory corruption in Office components (Word, Word Automation Services, SharePoint-related components, etc.). It affects a broad set of Office products across Windows and macOS (Word 2007 SP3, Office 2010 SP2, Wo...

CVE-2020-1482

CVE-2020-1482 is a Microsoft SharePoint Server XSS vulnerability. An authenticated attacker can send a crafted web request to an affected SharePoint server, causing the server to execute script in the context of the current user. Impact statements from the sources indicate the attacker could read...

CVE-2020-1500

CVE-2020-1500 is a SharePoint vulnerability in which an authenticated user could send a specially crafted request to a SharePoint Server, causing spoofing and cross-site scripting (XSS) in the user’s browser. The root cause is improper sanitization of web requests on SharePoint Server, enabling a...

CVE-2021-24071

CVE-2021-24071 is a Microsoft SharePoint Information Disclosure Vulnerability. The NVD entry lists a network-attack, low-complexity flaw with partial confidentiality impact (CVSSv2 4.0; CVSSv3.1 6.5; secrecy impact HIGH per CNA). Connected Nessus plugins describe multiple SharePoint vulnerabiliti...

CVE-2021-27052

CVE-2021-27052 is a Microsoft SharePoint Server information disclosure vulnerability affecting SharePoint Server 2016/2019 deployments. Public references in the provided connected data indicate exploitation relates to information disclosure (confidentiality impact) with remediation via security u...

CVE-2017-8501

CVE-2017-8501 is described across connected CNVD/OpenVAS entries as a memory corruption vulnerability in Microsoft Office components (notably Word/Excel/SharePoint) that can be triggered by specially crafted files to yield remote code execution or DoS under the current user. The root cause cited ...

CVE-2020-1576

CVE-2020-1576 is a remote code execution vulnerability in Microsoft SharePoint. According to the provided sources, the flaw occurs when SharePoint fails to validate the source markup of an application package uploaded to an affected SharePoint version, allowing an attacker to execute arbitrary co...

CVE-2025-29976

CVE-2025-29976 affects Microsoft SharePoint (Office SharePoint Server/SharePoint Server) with an elevation-of-privilege vulnerability due to improper privilege management. An attacker with local access and low privileges could elevate privileges on the affected system, as indicated by the CVE act...

CVE-2017-8629

CVE-2017-8629 affects Microsoft SharePoint Server 2013 SP1 and is an elevation of privilege vulnerability caused by improper sanitization of crafted web requests, enabling cross-site scripting and potential unauthorized actions in the user’s security context. Connected sources confirm the vulnera...

CVE-2018-8580

An information disclosure vulnerability exists in Microsoft SharePoint Server due to certain modes of the search function being susceptible to cross-site search attacks , which are a variant of cross-site request forgery (CSRF) . When users are simultaneously logged into SharePoint and visit a ma...

CVE-2019-0958

The provided documents describe CVE-2019-0958 as an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by improper sanitization of specially crafted web requests. Affected product: SharePoint Server. Root cause: failure to sanitize web input leading to privilege escalation...

CVE-2020-0933

Technical details about CVE-2020-0933 are not publicly available in the provided documents (no affected products, exploit info, or remediation details are described). Monitor for updates.

CVE-2020-0975

CVE-2020-0975 is a SharePoint Spoofing vulnerability in Microsoft SharePoint Server. The issue arises when SharePoint does not properly sanitize a specially crafted web request to the affected server, enabling spoofing under the SharePoint server context. Connected sources confirm this CVE as par...

CVE-2021-40484

CVE-2021-40484 is a Microsoft SharePoint Server spoofing vulnerability. Public records confirm a spoofing risk tied to SharePoint Server components, with a high-severity CVSS v3 base score from Microsoft’s advisory. The linked security update KB5002028 for SharePoint Server 2019 (and related patc...

CVE-2025-21393

CVE-2025-21393 affects Microsoft SharePoint Server (on‑prem). The vulnerability is described as a spoofing flaw that could allow impersonation of another user, with CVSS‑3.1 base metrics: Network access, low attack complexity, privileges required Low, user interaction required, confidentiality im...

CVE-2026-55132

Microsoft Word/Office vulnerability CVE-2026-55132 involves a double-free in Word that could allow a local attacker to execute arbitrary code. Affected product: Microsoft Word (Office suite). Root cause: memory management flaw (double free) in Word’s handling of certain documents. Impact: local c...

CVE-2026-56192

The CVE-2026-56192 entry describes a local, information-disclosure vulnerability in Microsoft Office caused by an out-of-bounds read. Affected product: Microsoft Office suite (Office components) per multiple connected sources. Root cause and exact vulnerable component are not fully detailed in th...

CVE-2018-0919

CVE-2018-0919 describes an information-disclosure vulnerability in Microsoft Office components (Word, Web Apps, SharePoint, etc.) caused by how variables are initialized. Connected OpenVAS entries corroborate affected products such as Word 2010/2013/2016, Word for Mac, Office Web Apps, and relate...

CVE-2020-0977

CVE-2020-0977 is a spoofing vulnerability in Microsoft SharePoint Server where a specially crafted web request is not properly sanitized. The available connected document (Nessus plugin for SharePoint April 2020 updates) lists CVE-2020-0977 under a spoofing family of issues, alongside other relat...

CVE-2020-1514

CVE-2020-1514 relates to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server. The issue arises when SharePoint does not properly sanitize a crafted web request, allowing an authenticated attacker to execute script in the user’s browser context, potentially reading restricted...

CVE-2025-47169

CVE-2025-47169 affects Microsoft Word (Office) via a heap-based buffer overflow in Word, enabling local code execution. The vulnerability is confirmed by multiple sources (MSRC and related advisories) and is addressed by June 2025 Word security updates (e.g., KB5002729/KB5002732). Remediation: in...