CVE-2026-55032

CVE-2026-55032 is a Microsoft Word remote code execution vulnerability reported as a use-after-free issue in Microsoft Office Word. The CVE entry specifies local attack vector with user interaction required, yielding a high severity (CVSS 3.1: 7.8, HIGH) and potential for arbitrary code execution...

CVE-2015-6038

CVE-2015-6038 affects Microsoft Office products including Excel 2007/2010/2013/2016 (Windows and Mac) and related components, as well as Excel Services on SharePoint Server and Office viewers. The vulnerability stems from memory corruption triggered by specially crafted Office documents, enabling...

CVE-2015-2375

Microsoft Excel ASLR Bypass (CVE-2015-2375) affects Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, and Excel Services on SharePoint Server 2010 SP2/2013 SP1. Root cause: crafted spreadsheet allows bypassing ASLR protection, enabling potential memory-disclosure or downst...

CVE-2019-0562

CVE-2019-0562 affects Microsoft SharePoint Server/SharePoint where a crafted web request is not properly sanitized, leading to elevation of privilege. Root cause: improper sanitization of input in SharePoint Server. Impact: privilege escalation within the affected SharePoint context; the CVSS det...

CVE-2020-0924

Technical details for CVE-2020-0924 are not publicly available in the provided documents. Monitor for updates.

CVE-2020-1227

CVE-2020-1227 is a Microsoft SharePoint Server XSS vulnerability caused by improper sanitization of crafted web requests. An authenticated attacker can send a specially crafted request to an affected SharePoint server, enabling cross-site scripting and script execution in the user’s browser with ...

CVE-2020-1580

CVE-2020-1580 is an XSS vulnerability in Microsoft SharePoint Server where improper sanitization of crafted web requests could allow an authenticated attacker to execute scripts in the user’s browser, potentially reading restricted content, impersonating the user, and altering permissions. The vu...

CVE-2026-20943

CVE-2026-20943 is a Microsoft Office Click-To-Run remote code execution issue caused by an untrusted search path that could allow local code execution. Connected sources confirm affected Office variants and that Microsoft released security updates in January 2026 (e.g., KB5002828/KB5002822 for di...

CVE-2026-45454

The CVE-2026-45454 entry documents a path traversal flaw in Microsoft SharePoint that enables remote code execution when an authorized user accesses a restricted path over a network. The issue affects Microsoft Office SharePoint and is described consistently across multiple sources (NVD, RH, EU E...

CVE-2016-7233

CVE-2016-7233 is an information-disclosure/out-of-bounds-read vulnerability in multiple Microsoft Office components (e.g., Word 2007, Office 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Web Apps 2010 SP2, SharePoint 2013 components, and Office Automation Services). A craft...

CVE-2018-8161

CVE-2018-8161 is described across sources as a remote code execution flaw in Microsoft Office products (Word, Office, SharePoint) caused by improper handling of in-memory objects. Connected CNVD records corroborate a memory-handling vulnerability that allows an attacker to execute arbitrary code ...

CVE-2019-1443

CVE-2019-1443 is an information-disclosure vulnerability in Microsoft SharePoint Server. An authenticated attacker who uploads a specially crafted file could leverage SharePoint functionality to obtain SMB hashes, with impact described as partial confidentiality exposure. The issue arises from ho...

CVE-2020-0925

Technical details for CVE-2020-0925 are not publicly available in the provided Connected documents. The EUVD entries mention malware unrelated to this CVE. Monitor for updates from official advisories and MSRC.

CVE-2020-1106

CVE-2020-1106 corresponds to a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server, where improper sanitization of a crafted web request can lead to an XSS condition on the affected server. The NVD entry notes a CVSS v3.1 base score of 6.1 (Network, Low attack complexity, User...

CVE-2025-47172

CVE-2025-47172 refers to a Microsoft SharePoint Server remote code execution vulnerability caused by improper neutralization of certain SQL elements in SharePoint (SQL injection). An authenticated attacker could execute code remotely over the network. Affected products include SharePoint Server o...

CVE-2026-55128

CVE-2026-55128 is a Use-after-free in Microsoft Word that enables local code execution by an unauthenticated attacker who powers the exploit via a crafted file/link. Affected product scope is Microsoft Word/Office as per Microsoft advisories; document does not specify exact vulnerable builds or p...

CVE-2010-3964

CVE-2010-3964 is an unrestricted file upload vulnerability in the Document Conversions Launcher Service of Microsoft Office SharePoint Server 2007 SP2, exploitable when the Document Conversions Load Balancer Service is enabled. A crafted SOAP request to TCP 8082 can lead to remote code execution ...

CVE-2015-1682

Microsoft Office Multiple Remote Code Execution Vulnerabilities (CVE-2015-1682) affect Office/SharePoint components across Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, Word/Excel/PowerPoint/SharePoint-related services, etc. Root cause: memory corruption triggered by processing a crafted...

CVE-2019-0830

Microsoft SharePoint Server is affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of crafted web requests. The issue is documented across multiple sources (e.g., CVE-2019-0830 and related entries) and is described as XSS in SharePoint. Connected documents confirm ...

CVE-2020-0972

CVE-2020-0972 is a spoofing vulnerability in Microsoft SharePoint Server where a specially crafted web request is not properly sanitized. The issue is tied to SharePoint’s handling of spoofing-related requests and is listed among a set of April 2020 SharePoint vulnerabilities in the Nessus plugin...

CVE-2020-1024

CVE-2020-1024 concerns a remote code execution in Microsoft SharePoint caused by the product failing to check the source markup of an application package. The connected Nessus plugins for SharePoint Server indicate this alongside other vulnerabilities across multiple versions (e.g., SharePoint Se...

CVE-2020-1183

Technical details (vulnerable product specifics, root cause, exploit information, mitigation) for CVE-2020-1183 are not provided in the connected documents. Monitor for updates from official advisories and third-party sources.

CVE-2020-1523

CVE-2020-1523 is a tampering vulnerability in Microsoft SharePoint Server related to how profile data is processed. An authenticated attacker can modify a targeted user’s profile data by sending a specially crafted request to the affected SharePoint Server. The issue is addressed by a security up...

CVE-2022-41037

CVE-2022-41037 is a Microsoft SharePoint Server remote code execution vulnerability. Public docs confirm a remote-code-execution issue in SharePoint Server and a security update path: KB5002283 (SharePoint Server 2013) and KB5002290 (SharePoint Server Subscription Edition) address the vulnerabili...

CVE-2024-49068

CVE-2024-49068 is a Microsoft SharePoint Elevation of Privilege vulnerability. The entry lists a high-severity impact with CVSSv3.1: base score 8.2 (NETWORK, ATTACK VECTOR), no user interaction, no privileges required, and CONFD/HIGH impact on confidentiality, LOW on integrity, NONE on availabili...

CVE-2010-1257

CVE-2010-1257 is described as an XSS flaw in the toStaticHTML API affecting InfoPath 2003/2007, SharePoint products, and IE8. Public docs here identify IE vulnerabilities addressed by MS10-035 (Internet Explorer cumulative security update) that resolves remote code execution/related issues. The C...

CVE-2010-3324

CVE-2010-3324 describes an IE8/SharePoint CSS @import-based XSS bypass. The connected MSKB MS10-035 documents a broader cumulative security update for Internet Explorer to address IE vulnerabilities (including remote code execution via crafted pages) and provides update guidance. However, the pro...

CVE-2015-1649

CVE-2015-1649 is a use-after-free vulnerability in Microsoft Office components (Word 2007 SP3, Office 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2) that allows remote code execution via a crafted ...

CVE-2016-7291

CVE-2016-7291 affects Microsoft Office components including Word 2007 SP3, Office 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2. A crafted document can cause information disclosure by reading memory...

CVE-2026-63514

Summary: CVE-2026-63514 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code remotely over a network. Affected component: SharePoint Server (deserialization path in untrusted data handling). Impact: Remote code execution with H...

CVE-2026-70355

CVE-2026-70355 affects Microsoft Office SharePoint/SharePoint Server; improper neutralization of input during web page generation (XSS) could allow an authorized attacker to elevate privileges over the network. The CVSSv3.1 base score is 7.3 (HIGH) with NETWORK attack vector, LOW attack complexit...

CVE-2016-7268

CVE-2016-7268 is an information-disclosure/Memory-read vulnerability in Microsoft Office products. The initial description lists how crafted Office documents can cause an out-of-bounds read or memory disclosure, allowing remote attackers to obtain sensitive information from process memory. Affect...

CVE-2017-0105

CVE-2017-0105 is an information-disclosure vulnerability in Microsoft Office components (Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Office Web Apps 2010 SP2) caused by an out-of-bounds re...

CVE-2018-8568

The CVE-2018-8568/8572 family concerns Microsoft SharePoint Server. A vulnerability exists where SharePoint does not properly sanitize/filter a specially crafted web request sent to an affected SharePoint server, enabling an authenticated attacker to elevate privileges. Affected products: Microso...

CVE-2019-0950

The connected Nessus findings identify CVE-2019-0950 as a Spoofing vulnerability in Microsoft SharePoint Server , arising from the product’s failure to properly sanitize a specially crafted web request. Affected software includes SharePoint Server 2019 (builds older than 16.0.10345.12101) and Sha...

CVE-2019-1296

CVE-2019-1296 is a remote code execution vulnerability in Microsoft SharePoint. The issue arises because APIs aren’t properly protected from unsafe input data, enabling potentially arbitrary code execution in the context of the SharePoint server. Reports in connected sources confirm the vulnerabi...

CVE-2020-1443

CVE-2020-1443 describes a spoofing vulnerability in Microsoft SharePoint Server caused by improper sanitization of a specially crafted web request. Multiple connected sources (NVD, CNVD, and related Nessus entries) reiterate that SharePoint Server does not properly sanitize crafted requests, enab...

CVE-2020-1451

CVE-2020-1451 is a Microsoft SharePoint Server XSS vulnerability caused by improper sanitization of crafted web requests. Public data in the provided documents shows a CVSS v3.1 base score of 5.4 (Network, Low privileges, UI: Required, Scope: Changed; Confidentiality/Integrity: Low) and notes the...

CVE-2024-38227

CVE-2024-38227 is a Microsoft SharePoint Server remote code execution vulnerability affecting on‑premises SharePoint Server. The CVSS 3.1 score is 7.2 ( HIGH ): attack vector NETWORK, privileges required HIGH, no user interaction, and impact to CONFIDENTIALITY, INTEGRITY, and AVAILABILITY rated H...

CVE-2024-43503

CVE-2024-43503 – Microsoft SharePoint Elevation of Privilege affects on‑premises SharePoint deployments (Server). The vulnerability is described as an elevation of privileges issue in SharePoint, enabling a local attacker with low privileges and no user interaction to escalate to high integrity/i...

CVE-2026-20947

CVE-2026-20947 is a Microsoft SharePoint/Office SharePoint Remote Code Execution vulnerability caused by improper neutralization of SQL elements in SharePoint. An attacker can trigger code execution over the network with low privileges and no user interaction on affected SharePoint Server deploym...

CVE-2026-45485

CVE-2026-45485: In Microsoft Office, an out-of-bounds read leads to local information disclosure. Documents confirm the vulnerability and its impact (local disclosure) with low severity (CVSS 3.1:3.3). Exploitation details and affected component/version specifics are not provided in the supplied ...

CVE-2008-4019

CVE-2008-4019 is an integer overflow in Excel’s REPT function used when parsing a formula within a cell, affecting multiple Windows and Mac Excel versions (e.g., 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1) and related viewers/compat packs. The vulnerability allows remote code execution if a ...

CVE-2010-0817

A cross-site scripting (XSS) vulnerability exists in Microsoft SharePoint Server 2007 (version 12.0.0.6421 and earlier) and SharePoint Services 3.0 SP1 and SP2 . The root cause is insufficient input validation of data supplied to the _layouts/help.aspx script, specifically via the cid0 paramete...

CVE-2019-1033

Technical details for CVE-2019-1033 are not publicly available in the provided documents. No specifics on affected versions, root cause, or fixes are present here. Monitor for updates via the cited sources.

CVE-2020-1101

CVE-2020-1101 describes a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server where the application does not properly sanitize a specially crafted web request. The issue affects SharePoint Server (per the CVE) and is corroborated by connected sources noting XSS in SharePoint S...

CVE-2020-1104

Technical details about CVE-2020-1104 are not publicly provided in the supplied documents. Monitor for updates from vendors and ENISA/NVD for confirmed fixes and affected products.

CVE-2021-43876

Technical details about CVE-2021-43876 (affected product, vector, impact, patch) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-21511

CVE-2026-21511 describes deserialization of untrusted data in Microsoft Office Outlook, enabling an unauthorized attacker to spoof over a network. Affected product: Microsoft Office Outlook. Root cause: unsafe deserialization of data. Impact: spoofing with network access; CVSS v3.1 base score 7.5...

CVE-2015-6117

CVE-2015-6117 affects Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1. The vulnerability arises from a security feature bypass where remote authenticated users can bypass access control by modifying a webpart, enabling cross-site scripting (XSS). The issue is documented as...