CVE-2025-47166

CVE-2025-47166 is a remote code execution vulnerability in Microsoft SharePoint Server/Office SharePoint caused by deserialization of untrusted data. An authenticated attacker could trigger code execution over the network on the affected server. The entry is tracked with a high CVSS v3.1 base sco...

CVE-2026-55134

CVE-2026-55134 is a stack-based buffer overflow in Microsoft Word (Office) that can allow a local attacker to execute arbitrary code. The CVE entry is corroborated by multiple sources in the Connected documents, which identify Word as the affected component and describe local code execution as th...

CVE-2015-2468

CVE-2015-2468 affects Microsoft Office components across Word/Office for Windows and Mac, including Word 2007 SP3, 2010 SP2, 2013 SP1, Office for Mac 2011/2016, Office Compatibility Pack SP3, Word Viewer, and related SharePoint/Office Web Apps. The root cause is memory corruption triggered by pro...

CVE-2016-3281

CVE-2016-3281 is a Microsoft Office memory corruption vulnerability affecting Office 2010 SP2, Word 2010 SP2, Word 2013 SP1/RT, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2. The root cause is memory corruptio...

CVE-2017-8513

CVE-2017-8513 is a remote code execution vulnerability in Microsoft PowerPoint (Office suite) caused by improper handling of objects in memory. CVSSv3 base score 7.8 (HIGH) with local attack vector, user interaction required. MITRE/attack details are not specified in the provided documents, and e...

CVE-2017-8569

CVE-2017-8569 affects Microsoft SharePoint Server. The issue stems from improper sanitization of crafted web requests, enabling elevation of privilege and cross-site scripting in the authenticated user context. Affected product scope includes SharePoint Server (notably 2016/Enterprise variants); ...

CVE-2022-41036

CVE-2022-41036 is a remote code execution vulnerability affecting Microsoft SharePoint Server (on‑premises). The connected documents confirm it as a SharePoint Server RCE issue that was addressed by Microsoft security updates. In particular, security updates KB5002287 (SharePoint Server 2016) and...

CVE-2014-0260

CVE-2014-0260 affects Microsoft Word and related Office components (Word Viewer, Office Web Apps, SharePoint, etc.). The issue arises from memory corruption while parsing crafted Office documents, enabling remote code execution or, per source, possible denial of service. The vulnerability is mapp...

CVE-2026-20943

CVE-2026-20943 is a Microsoft Office Click-To-Run remote code execution issue caused by an untrusted search path that could allow local code execution. Connected sources confirm affected Office variants and that Microsoft released security updates in January 2026 (e.g., KB5002828/KB5002822 for di...

CVE-2010-3243

CVE-2010-3243 describes an HTML sanitization vulnerability (HTML Sanitization Vulnerability) causing cross-site scripting in Microsoft Internet Explorer 8 and in SharePoint components: Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2. The root cause is improper filtering ...

CVE-2018-8572

CVE-2018-8572 affects Microsoft SharePoint, specifically SharePoint Server and SharePoint. The vulnerability arises because the server does not properly sanitize/filter a specially crafted web request, enabling an authenticated attacker to elevate privileges on the affected SharePoint Server. Con...

CVE-2024-43466

Microsoft SharePoint Server Denial of Service vulnerability (CVE-2024-43466) affects on-prem SharePoint Server. The provided documents describe a denial-of-service issue but do not specify the exact vulnerable component, root cause, or affected product versions. Related entries indicate security ...

CVE-2025-30382

CVE-2025-30382 is a Microsoft SharePoint Server remote code execution vulnerability caused by deserialization of untrusted data in Office SharePoint. The CVE affects SharePoint Server environments and is exploitable locally with user interaction required (per CVSS vector: Local, Privileges=None, ...

CVE-2026-45454

The CVE-2026-45454 entry documents a path traversal flaw in Microsoft SharePoint that enables remote code execution when an authorized user accesses a restricted path over a network. The issue affects Microsoft Office SharePoint and is described consistently across multiple sources (NVD, RH, EU E...

CVE-2013-3849

Summary: CVE-2013-3849 is part of a set of related Word memory corruption vulnerabilities affecting Microsoft Word Automation Services and related Word components (SharePoint 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility...

CVE-2016-0054

CVE-2016-0054 affects multiple Microsoft Office components (notably Excel across Windows and macOS, including Office viewers/SharePoint services). The underlying issue is memory corruption triggered by processing a crafted Office document, enabling remote code execution. Public references describ...

CVE-2024-38228

CVE-2024-38228 is a Microsoft SharePoint Server remote code execution vulnerability. Public sources indicate it affects SharePoint Server and is addressed by security updates KB5002640 (SharePoint Server Subscription Edition), KB5002624 (SharePoint Enterprise Server 2016), and KB5002639 (SharePoi...

CVE-2025-30378

CVE-2025-30378 is a Microsoft SharePoint vulnerability described as a deserialization of untrusted data in Office SharePoint that allows a local attacker to execute code. The NVD entry lists a CVSSv3.1 base score of 7.0 (HIGH) with LOCAL attack vector, HIGH impact to confidentiality, integrity, a...

CVE-2026-20947

CVE-2026-20947 is a Microsoft SharePoint/Office SharePoint Remote Code Execution vulnerability caused by improper neutralization of SQL elements in SharePoint. An attacker can trigger code execution over the network with low privileges and no user interaction on affected SharePoint Server deploym...

CVE-2016-0011

CVE-2016-0011 affects Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1, where remote authenticated users can bypass the Access Control Policy and perform cross-site scripting (XSS) by modifying a webpart. The root cause is a security feature bypass in SharePoint that allows...

CVE-2021-42320

CVE-2021-42320 is a spoofing vulnerability affecting Microsoft SharePoint Server (including Subscription Edition and on-premises releases like 2016/2019). Exploitation could allow an attacker to perform actions with the privileges of another user. Microsoft’s December 2021 security update KB50020...

CVE-2012-1860

CVE-2012-1860 affects Microsoft SharePoint components: SharePoint Server 2007 (SP2/SP3), SharePoint Server 2010 (Gold/SP1), and Office Web Apps 2010 (Gold/SP1). The root cause is improper permission checks for search scopes, enabling remote authenticated users to view or tamper with other users’ ...

CVE-2012-2520

CVE-2012-2520 is a cross-site scripting vulnerability in Microsoft’s HTML sanitization component affecting multiple products (InfoPath 2007/2010, Communicator/Lync 2010, SharePoint Server/Foundation, Groove Server, Office Web Apps). The issue arises from improper input filtering in the HTML sanit...

CVE-2015-2375

Microsoft Excel ASLR Bypass (CVE-2015-2375) affects Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, and Excel Services on SharePoint Server 2010 SP2/2013 SP1. Root cause: crafted spreadsheet allows bypassing ASLR protection, enabling potential memory-disclosure or downst...

CVE-2015-2558

CVE-2015-2558 is a use-after-free memory corruption vulnerability in Microsoft Office components (e.g., Excel 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, 2016; Office for Mac 2011/2016; Excel Services on SharePoint Server 2007 SP3/2010 SP2/2013 SP1) that allows remote code execution via a long fileVersi...

CVE-2015-6039

CVE-2015-6039 is an XSS vulnerability in Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 that allows remote authenticated users to inject arbitrary web script or HTML via crafted content in an Office Marketplace instance (Security Feature Bypass). Public sources confirm th...

CVE-2026-35439

CVE-2026-35439 is a remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data. An authorized attacker can exploit this over a network to execute code on affected systems. The CVE is associated with SharePoint Server (on‑premises) and the approv...

CVE-2026-64916

CVE-2026-64916 affects Microsoft Office SharePoint Server and relates to improper neutralization of input during web page generation (XSS), enabling an authorized attacker to spoof over a network. The CVSS 3.1 base score is 4.6 (Medium) with Network access, Low attack complexity, Low privileges r...

CVE-2015-1653

CVE-2015-1653 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. Affected products include SharePoint Server and Foundation compon...

CVE-2018-8149

Technical details for CVE-2018-8149 are not publicly available in the provided documents. Monitor for updates.

CVE-2018-8635

CVE-2018-8635 affects Microsoft SharePoint Server and SharePoint by an elevation-of-privilege flaw where an auth’d attacker can craft an authentication request to trigger server-side logic. Root cause: improper sanitization of a crafted authentication request, enabling code execution in the Share...

CVE-2011-1893

CVE-2011-1893 corresponds to a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint components: Office SharePoint Server 2010, Windows SharePoint Services 2.0/3.0 SP2, and SharePoint Foundation 2010. The root cause is improper handling of URI parameters, enabling remote attacke...

CVE-2013-5059

The CVE-2013-5059 entry corresponds to remote code execution in Microsoft SharePoint Server components (SharePoint Server 2010 SP1/SP2, 2013, and Office Web Apps 2013) via crafted page content. Connected sources (OPENVAS NASLs) describe multiple SharePoint-related RCE vulnerabilities (MS13-100) a...

CVE-2015-1633

CVE-2015-1633 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint components: SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1. The flaw allows remote authenticated users to inject arbitr...

CVE-2015-1636

CVE-2015-1636 is an XSS vulnerability in Microsoft SharePoint affecting SharePoint Foundation 2013 Gold/SP1 and SharePoint Server 2013 Gold/SP1. The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted request. CVSS v2 reveals a base score of 3.5 (Low) with...

CVE-2018-8155

Technical details about CVE-2018-8155 are not publicly provided in the connected documents. No affected products, versions, impact, or fixes are specified here. Monitor for official updates from vendor advisories and vulnerability feeds.

CVE-2018-8168

Technical details for CVE-2018-8168 are not publicly available in the provided documents. Monitor for updates.

CVE-2012-1862

CVE-2012-1862 is an open-redirect vulnerability affecting Microsoft Office SharePoint Server 2007 SP2 and SP3. The issue arises from improper handling/sanitization of user-supplied input in SharePoint’s URL processing, allowing an attacker to redirect victims to arbitrary external sites and poten...

CVE-2013-3179

CVE-2013-3179 is a cross-site scripting (XSS) vulnerability affecting Microsoft SharePoint Server family (2007 SP3, 2010 SP1/SP2, 2013). The issue allows remote attackers to inject arbitrary web script or HTML via a crafted request. Connected OpenVAS entries corroborate MS13-067 as the related se...

CVE-2013-3847

Microsoft Word Memory Corruption Vulnerability (CVE-2013-3847) affects Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer. A crafted Office document coul...

CVE-2015-0064

CVE-2015-0064 corresponds to a memory-corruption remote-code-execution vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer and Office Compatibility Pack SP3. The issue arises when processing a crafte...

CVE-2018-8156

CVE-2018-8156 is a Microsoft SharePoint Server elevation-of-privilege issue. Connected sources confirm the vulnerability arises when SharePoint Server (and related Project Server variants) fails to properly filter specially crafted web requests, enabling an attacker to escalate privileges. Severa...

CVE-2026-55035

CVE-2026-55035 is an information-disclosure vulnerability described as an out-of-bounds read in Microsoft Office that allows a locally authenticated attacker to disclose information. Connected sources confirm this affects multiple Office components (Word, Excel, PowerPoint, SharePoint, etc.) and ...

CVE-2026-63514

Summary: CVE-2026-63514 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code remotely over a network. Affected component: SharePoint Server (deserialization path in untrusted data handling). Impact: Remote code execution with H...

CVE-2014-2816

CVE-2014-2816 affects Microsoft SharePoint Server 2013 (Gold/SP1) and SharePoint Foundation 2013 (Gold/SP1). The vulnerability allows remote authenticated users to gain privileges via a Trojan horse app that runs a custom action in the SharePoint extensibility model (SharePoint Page Content Vulne...

CVE-2014-6357

CVE-2014-6357 is a use-after-free remote code execution vulnerability reported in Microsoft Office products (Office 2010 SP2, Office 2013 SP1/Gold, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2/2013) and related Office Web ...

CVE-2018-8252

CVE-2018-8252 affects Microsoft SharePoint Server. The connected documents describe an elevation-of-privilege flaw caused by the server not properly sanitizing or filtering specially crafted web requests, allowing a remote attacker to gain elevated privileges. The vulnerability is associated with...

CVE-2025-53733

CVE-2025-53733 affects Microsoft Word (Office). The issue is caused by incorrect conversion between numeric types in Word, enabling a local attacker to execute arbitrary code when a specially crafted document is opened or when Preview Pane is used, per vendor descriptions and multiple security pa...

CVE-2026-40357

Technical details for CVE-2026-40357 are not publicly available in the provided documents. Monitor for updates from Microsoft and CVE records.

CVE-2024-49064

CVE-2024-49064 corresponds to a Microsoft SharePoint Information Disclosure Vulnerability. Public documents describe an information disclosure issue in SharePoint that could lead to exposure of sensitive data. Affected products include Microsoft SharePoint Server/SharePoint Enterprise Server vari...