Sharepoint Server Security Vulnerabilities and Issues — Page 9 of Sharepoint Server CVE List

Lucene search

MicrosoftSharepoint Server

460 matches found

cve•added 2018/05/09 7:29 p.m.•64 views

CVE-2018-8149

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoin...

5.4CVSS5.5AI score0.00473EPSS

cve•added 2018/05/09 7:29 p.m.•64 views

CVE-2018-8156

5.4CVSS5.5AI score0.00473EPSS

cve•added 2024/10/08 6:15 p.m.•64 views

CVE-2024-43503

Microsoft SharePoint Elevation of Privilege Vulnerability

7.8CVSS7.6AI score0.00701EPSS

cve•added 2015/03/11 10:59 a.m.•63 views

CVE-2015-1633

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Mic...

3.5CVSS4.6AI score0.07905EPSS

cve•added 2018/06/14 12:29 p.m.•63 views

CVE-2018-8252

5.4CVSS5.5AI score0.00869EPSS

cve•added 2015/04/14 8:59 p.m.•62 views

CVE-2015-1649

Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office doc...

9.3CVSS7.5AI score0.55659EPSS

cve•added 2015/04/14 8:59 p.m.•62 views

CVE-2015-1653

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

4.3CVSS5AI score0.08963EPSS

cve•added 2016/01/13 5:59 a.m.•62 views

CVE-2016-0011

Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulne...

5.4CVSS5.3AI score0.01683EPSS

cve•added 2021/12/15 3:15 p.m.•62 views

CVE-2021-42320

Microsoft SharePoint Server Spoofing Vulnerability

8CVSS6AI score0.00669EPSS

cve•added 2014/01/15 4:13 p.m.•61 views

CVE-2014-0260

Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of se...

9.3CVSS8.7AI score0.28644EPSS

cve•added 2016/02/10 11:59 a.m.•61 views

CVE-2016-0054

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Serv...

9.3CVSS7.7AI score0.28449EPSS

cve•added 2013/09/11 2:3 p.m.•60 views

CVE-2013-3847

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corrupti...

9.3CVSS7.5AI score0.61623EPSS

cve•added 2013/12/11 12:55 a.m.•60 views

CVE-2013-5059

Microsoft SharePoint Server 2010 SP1 and SP2 and 2013, and Office Web Apps 2013, allows remote attackers to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerabilities."

6.8CVSS7.6AI score0.11014EPSS

cve•added 2015/02/11 3:1 a.m.•59 views

CVE-2015-0064

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Offi...

9.3CVSS8AI score0.66307EPSS

cve•added 2016/01/13 5:59 a.m.•59 views

CVE-2015-6117

6.1CVSS5.3AI score0.01683EPSS

cve•added 2016/02/10 11:59 a.m.•59 views

CVE-2016-0053

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute ...

9.3CVSS7.6AI score0.22765EPSS

cve•added 2025/06/10 5:23 p.m.•59 views

CVE-2025-47168

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

7.8CVSS8AI score0.00068EPSS

cve•added 2012/10/09 9:55 p.m.•58 views

CVE-2012-2520

Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office W...

4.3CVSS5.6AI score0.2805EPSS

cve•added 2018/04/12 1:29 a.m.•58 views

CVE-2018-1032

5.4CVSS5.5AI score0.00536EPSS

cve•added 2014/08/12 9:55 p.m.•57 views

CVE-2014-2816

Microsoft SharePoint Server 2013 Gold and SP1 and SharePoint Foundation 2013 Gold and SP1 allow remote authenticated users to gain privileges via a Trojan horse app that executes a custom action in the context of the SharePoint extensibility model, aka "SharePoint Page Content Vulnerability."

9.3CVSS6.4AI score0.38643EPSS

cve•added 2014/12/11 12:59 a.m.•57 views

CVE-2014-6357

Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 Gold and SP1, and Office Web Apps 2010 SP2 and 2013 Gold...

9.3CVSS8.8AI score0.55659EPSS

cve•added 2008/08/12 11:41 p.m.•56 views

CVE-2008-3006

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel Viewer; Office Compatibility Pack 2007 Gold and SP1; Office SharePoint Server 2007 Gold and SP1; and Office 2004 and 2008 for Mac do not properly parse Country rec...

9.3CVSS7.3AI score0.68326EPSS

cve•added 2012/07/10 9:55 p.m.•56 views

CVE-2012-1862

Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability."

6.8CVSS6.5AI score0.11814EPSS

cve•added 2018/05/09 7:29 p.m.•56 views

CVE-2018-8155

5.4CVSS5.5AI score0.00473EPSS

cve•added 2024/12/12 2:4 a.m.•56 views

CVE-2024-49064

Microsoft SharePoint Information Disclosure Vulnerability

6.5CVSS6.1AI score0.00275EPSS

cve•added 2011/09/15 12:26 p.m.•55 views

CVE-2011-1893

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability."

4.3CVSS5.1AI score0.47875EPSS

cve•added 2013/10/09 2:53 p.m.•55 views

CVE-2013-3889

Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server 2013 allow remote attackers to execute arbitrar...

9.3CVSS7.4AI score0.5514EPSS

cve•added 2015/10/14 1:59 a.m.•55 views

CVE-2015-6039

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance, aka "Microsoft SharePoint Security Feature Bypass Vulne...

3.5CVSS5.3AI score0.0902EPSS

cve•added 2017/08/08 9:29 p.m.•55 views

CVE-2017-8654

Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting (XSS) vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability".

5.4CVSS5AI score0.01102EPSS

cve•added 2018/02/15 2:29 a.m.•55 views

CVE-2018-0864

SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability".

5.4CVSS5.3AI score0.01094EPSS

cve•added 2010/02/26 7:30 p.m.•54 views

CVE-2010-0716

_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and ...

3.5CVSS5.5AI score0.1627EPSS

cve•added 2011/09/15 12:26 p.m.•54 views

CVE-2011-1989

Microsoft Excel 2003 SP3 and 2007 SP2; Excel in Office 2007 SP2; Excel 2010 Gold and SP1; Excel in Office 2010 Gold and SP1; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2...

9.3CVSS7.5AI score0.59677EPSS

cve•added 2013/04/09 10:55 p.m.•54 views

CVE-2013-1290

Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location,...

3.5CVSS6.1AI score0.19287EPSS

cve•added 2013/09/11 2:3 p.m.•54 views

CVE-2013-3179

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

4.3CVSS5AI score0.11881EPSS

cve•added 2015/03/11 10:59 a.m.•54 views

CVE-2015-0086

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2,...

9.3CVSS7.6AI score0.27375EPSS

cve•added 2025/05/13 5:16 p.m.•54 views

CVE-2025-30378

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

7CVSS7.4AI score0.00162EPSS

cve•added 2025/06/10 5:23 p.m.•54 views

CVE-2025-47172

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

8.8CVSS8.8AI score0.00174EPSS

cve•added 2025/07/08 5:15 p.m.•54 views

CVE-2025-49704

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

8.8CVSS6.9AI score0.00296EPSS

cve•added 2013/09/11 2:3 p.m.•53 views

CVE-2013-3857

Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of ...

9.3CVSS7.6AI score0.5796EPSS

cve•added 2025/06/10 5:23 p.m.•53 views

CVE-2025-47163

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

8.8CVSS8.7AI score0.01629EPSS

cve•added 2011/09/15 12:26 p.m.•52 views

CVE-2011-1890

Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via a post, aka "Editform Script Injection Vulnerability."

4.3CVSS5.8AI score0.40973EPSS

cve•added 2013/09/11 2:3 p.m.•52 views

CVE-2013-3858

9.3CVSS7.5AI score0.61623EPSS

cve•added 2015/10/14 1:59 a.m.•52 views

CVE-2015-2556

The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (...

4.3CVSS6.6AI score0.39143EPSS

cve•added 2025/06/10 5:23 p.m.•52 views

CVE-2025-47169

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

7.8CVSS7.9AI score0.00068EPSS

cve•added 2008/11/10 3:23 p.m.•51 views

CVE-2008-5026

Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML...

3.5CVSS5.2AI score0.1627EPSS

cve•added 2015/10/14 1:59 a.m.•51 views

CVE-2015-6037

Cross-site scripting (XSS) vulnerability in Microsoft Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, and SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or ...

3.5CVSS4.7AI score0.10637EPSS

cve•added 2025/05/13 5:15 p.m.•51 views

CVE-2025-29976

Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.

7.8CVSS7.6AI score0.00061EPSS

cve•added 2011/09/15 12:26 p.m.•50 views

CVE-2011-1990

Microsoft Excel 2007 SP2; Excel in Office 2007 SP2; Excel Viewer SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Excel Services on Office SharePoint Server 2007 SP2 do not properly validate the sign of an unspecified array index, which allows remote attacke...

9.3CVSS7.5AI score0.58631EPSS

cve•added 2015/05/13 10:59 a.m.•48 views

CVE-2015-1700

Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "Microsoft SharePoint Page Content Vulnerabilities."

6CVSS7.3AI score0.28764EPSS

cve•added 2025/06/10 5:23 p.m.•48 views

CVE-2025-47166

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

8.8CVSS8.7AI score0.03546EPSS

Total number of security vulnerabilities460