{"id": "SECURITYVULNS:DOC:16950", "bulletinFamily": "software", "title": "OTRS <= 2.0.x XSS/XSRF", "description": "---------------------------------------------------------------------------------\r\n| ____ ____.__ __ |\r\n| \ \ / /|__|_______/ |_ __ _______ ___ |\r\n| \ Y / | \_ __ \ __\ | \__ \ \ \/ / |\r\n| \ / | || | \/| | | | // __ \_> < |\r\n| \___/ |__||__| |__| |____/(____ /__/\_ \ |\r\n| \/ \/ |\r\n| Security without illusions |\r\n| www.virtuax.be |\r\n| |\r\n---------------------------------------------------------------------------------\r\n\r\n\r\n Application: OTRS\r\n Vulnerable Versions: <= v2.0.x\r\n Vulnerability: XSS/XSRF\r\n\r\n Vendor: http://www.otrs.org\r\n Vendor Status: Notified\r\n\r\n Found: 07-05-2007\r\n Public Release Date: 07-05-2007\r\n Last modified: 07-05-2007\r\n Author: ciri\r\n E-mail: ciri[a.t]virtuax[d.o.t]be\r\n \r\n reference: http://www.virtuax.be/advisories/Advisory5-07052007.txt\r\n\r\n=================================================================================\r\n\r\nShouts to the VirtuaX Crew & Community!\r\n\r\n=================================================================================\r\n\r\n\r\n\r\nI. Background\r\n-------------\r\n\r\n"OTRS is an Open source Ticket Request System with many features to manage customer\r\ntelephone calls and e-mails. The system is built to allow your support, sales,\r\npre-sales, billing, internal IT, helpdesk, etc. department to react quickly to\r\ninbound inquiries"\r\n by otrs.org\r\n\r\n\r\nII. Vulnerablity\r\n----------------\r\n\r\nOTRS is vulnerable to a XSS/XSRF. It is possible to inject code into the\r\nSubaction parameter. Authentication is required to reach the page, but a\r\nnon-authenticated user will be asked to login and the attack will still be carried\r\nout. XSRF is ofcourse also possible in this case.\r\n\r\nIIa. Affected Versions\r\n----------------------\r\n\r\nOTRS 2.0.4 was tested and appears to be vulnerable. I've tested version 2.2.0 and\r\nit doesn't seem to be vulnerable anymore.\r\n\r\nIII. PoC\r\n--------\r\n\r\nhttp://server/otrs/index.pl?Action=AgentTicketMailbox&Subaction=<img src=\r\nhttps://server/otrs/images/Standard/new-message.png onLoad=javascript:alert('hello');>\r\n\r\nCopyright 2007 by ciri from Virtuax.be All rights reserved. 1", "published": "2007-05-08T00:00:00", "modified": "2007-05-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:16950", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:22", "edition": 1, "viewCount": 589, "enchantments": {"score": {"value": 0.8, "vector": "NONE", "modified": "2018-08-31T11:10:22", "rev": 2}, "dependencies": {"references": [{"type": "mskb", "idList": ["KB2526297", "KB2501721", "KB317244", "KB980408", "KB981401", "KB2785908", "KB953331", "KB2510690", "KB3191913", "KB2874216"]}], "modified": "2018-08-31T11:10:22", "rev": 2}, "vulnersScore": 0.8}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}}

{"nessus": [{"id": "WEB_APPLICATION_SCANNING_112740", "hash": "db17ca5b16fdee5f316032657feab4f4", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-10-08T23:47:22", "history": [{"bulletin": {"id": "WEB_APPLICATION_SCANNING_112740", "hash": "0b4fa6773b6b2831d00010a3f2694380", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-05T12:49:28", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4486682", "KB4462175", "KB4486677", "KB4486694", "KB4486688", "KB4486708", "KB4486687", "KB4486700", "KB4484531", "KB4486676"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16953", "CVE-2020-16929", "CVE-2020-16941", "CVE-2020-16945", "CVE-2020-16952", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16929", "MS:CVE-2020-16941", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16951"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-05T12:49:28", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-08-05T12:49:28", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "Binary data WEB_APPLICATION_SCANNING_112740", "naslFamily": "Component Vulnerability", "cpe": [], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-05T12:49:28", "differentElements": ["cpe", "sourceData"], "edition": 1}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112740", "hash": "60c4c1a6f11cb5fa0d9ab6585d045011", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-06T13:25:21", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL", "WEB_APPLICATION_SCANNING_112738", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4462175", "KB4484531", "KB4486677", "KB4486694", "KB4486687", "KB4486682", "KB4486676", "KB4486700", "KB4486708", "KB4486688"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16950", "CVE-2020-16952", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16948", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16950", "MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16945"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-06T13:25:21", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-06T13:25:21", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-06T13:25:21", "differentElements": ["nessusSeverity"], "edition": 2}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112740", "hash": "71372c1202deab9a5de7b6a62c639a92", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-19T12:03:14", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486700", "KB4486708", "KB4486688", "KB4486694", "KB4486676", "KB4484531", "KB4486687", "KB4486677", "KB4462175", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16953", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16941", "CVE-2020-16929"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16945", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941", "MS:CVE-2020-16944", "MS:CVE-2020-16950", "MS:CVE-2020-16948"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-19T12:03:14", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-19T12:03:14", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-19T12:03:14", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112740", "hash": "efc4ee4ad8b059f792bde95e5b1612d2", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-16T23:55:23", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486688", "KB4486676", "KB4462175", "KB4486708", "KB4486677", "KB4486700", "KB4486694", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16944", "CVE-2020-16946", "CVE-2020-16952", "CVE-2020-16950"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16944", "MS:CVE-2020-16948", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16946", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-16T23:55:23", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-16T23:55:23", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-16T23:55:23", "differentElements": ["exploitEase"], "edition": 4}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112740", "hash": "7c5297b1078737b1875f0569d4ab3fee", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2013 < 15.0.5285.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112740", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-23T00:02:13", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486676", "KB4462175", "KB4486708", "KB4486682", "KB4486688", "KB4486700", "KB4486677", "KB4486694"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16941", "CVE-2020-16952", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16944", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16953"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16948", "MS:CVE-2020-16941", "MS:CVE-2020-16953", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16950", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-23T00:02:13", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-23T00:02:13", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-23T00:02:13", "differentElements": ["cvssScoreSource"], "edition": 5}], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486674", "KB4486688", "KB4486677", "KB4486682", "KB4486687", "KB4486708", "KB4486700", "KB4486689", "KB4486678", "KB4486676", "KB4486707", "KB4486694", "KB4462175", "KB4486695"]}, {"type": "cve", "idList": ["CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16942", "CVE-2020-16948", "CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16941"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16950", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16929", "MS:CVE-2020-16953", "MS:CVE-2020-16951", "MS:CVE-2020-16944", "MS:CVE-2020-16941", "MS:CVE-2020-16942", "MS:CVE-2020-16945", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-10-08T23:47:22", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-10-08T23:47:22", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112740", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2013 build 15.0.5285.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-16929", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.nessus.NessusBulletin", "robots.models.base.Bulletin"]}, {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "86b53f8f0a544d02eddcca7c35e71dba", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-10-08T23:47:24", "history": [{"bulletin": {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "246009c07dbc491b1129b55876570db0", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-05T12:49:29", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4486682", "KB4462175", "KB4486677", "KB4486694", "KB4486688", "KB4486708", "KB4486687", "KB4486700", "KB4484531", "KB4486676"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16953", "CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16941", "CVE-2020-16945", "CVE-2020-16952", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16929", "MS:CVE-2020-16941", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16951"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-05T12:49:29", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-08-05T12:49:29", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "Binary data WEB_APPLICATION_SCANNING_112738", "naslFamily": "Component Vulnerability", "cpe": [], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-05T12:49:29", "differentElements": ["cpe", "sourceData"], "edition": 1}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "d899ed7ace8d836ad8c321d85be4f99e", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-06T13:25:22", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4462175", "KB4484531", "KB4486677", "KB4486694", "KB4486687", "KB4486682", "KB4486676", "KB4486700", "KB4486708", "KB4486688"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16950", "CVE-2020-16952", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16948", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16944"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16950", "MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16945"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-06T13:25:22", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-06T13:25:22", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-06T13:25:22", "differentElements": ["nessusSeverity"], "edition": 2}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "ac6c37a7a15e33f86e3fde0070120f80", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-19T12:03:15", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486700", "KB4486708", "KB4486688", "KB4486694", "KB4486676", "KB4484531", "KB4486687", "KB4486677", "KB4462175", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16953", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16941", "CVE-2020-16929"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16945", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941", "MS:CVE-2020-16944", "MS:CVE-2020-16950", "MS:CVE-2020-16948"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-19T12:03:15", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-19T12:03:15", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-19T12:03:15", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "09ed6f422ddf0896278fff09c0b08749", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-16T23:55:25", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486688", "KB4486676", "KB4462175", "KB4486708", "KB4486677", "KB4486700", "KB4486694", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16944", "CVE-2020-16946", "CVE-2020-16952", "CVE-2020-16950"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16944", "MS:CVE-2020-16948", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16946", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-16T23:55:25", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-16T23:55:25", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-16T23:55:25", "differentElements": ["exploitEase"], "edition": 4}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112738", "hash": "5ca5b478cacfb2e5f671cefda004e444", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2019 < 16.0.10367.20000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112738", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-23T00:02:14", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486676", "KB4462175", "KB4486708", "KB4486682", "KB4486688", "KB4486700", "KB4486677", "KB4486694"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16941", "CVE-2020-16952", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16944", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16953"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16948", "MS:CVE-2020-16941", "MS:CVE-2020-16953", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16950", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-23T00:02:14", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-23T00:02:14", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-23T00:02:14", "differentElements": ["cvssScoreSource"], "edition": 5}], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486674", "KB4486688", "KB4486677", "KB4486682", "KB4486687", "KB4486708", "KB4486700", "KB4486689", "KB4486678", "KB4486676", "KB4486707", "KB4486694", "KB4462175", "KB4486695"]}, {"type": "cve", "idList": ["CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16942", "CVE-2020-16948", "CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16951", "CVE-2020-16941"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16950", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16929", "MS:CVE-2020-16953", "MS:CVE-2020-16951", "MS:CVE-2020-16944", "MS:CVE-2020-16941", "MS:CVE-2020-16942", "MS:CVE-2020-16945", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-10-08T23:47:24", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-10-08T23:47:24", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112738", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2019 build 16.0.10367.20000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-16929", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.nessus.NessusBulletin", "robots.models.base.Bulletin"]}, {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "7f7c2359532e03d292b62ef9cf15094d", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-10-08T23:47:22", "history": [{"bulletin": {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "09507c5c48e9d92734d505bda6b139ad", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-05T12:49:29", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4486682", "KB4462175", "KB4486677", "KB4486694", "KB4486688", "KB4486708", "KB4486687", "KB4486700", "KB4484531", "KB4486676"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16953", "CVE-2020-16929", "CVE-2020-16941", "CVE-2020-16945", "CVE-2020-16952", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16929", "MS:CVE-2020-16941", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16951"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-05T12:49:29", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-08-05T12:49:29", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "Binary data WEB_APPLICATION_SCANNING_112737", "naslFamily": "Component Vulnerability", "cpe": [], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-05T12:49:29", "differentElements": ["cpe", "sourceData"], "edition": 1}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "9e8a21e9477b76887f0a88d4a20344b4", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-06T13:25:21", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112740", "MACOS_MS20_OCT_OFFICE.NASL"]}, {"type": "mskb", "idList": ["KB4462175", "KB4484531", "KB4486677", "KB4486694", "KB4486687", "KB4486682", "KB4486676", "KB4486700", "KB4486708", "KB4486688"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16950", "CVE-2020-16952", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16948", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16944"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16950", "MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16945"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-06T13:25:21", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-06T13:25:21", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-06T13:25:21", "differentElements": ["nessusSeverity"], "edition": 2}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "10e1b382cde66e873ff0a77bdb59e67c", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-19T12:03:14", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486700", "KB4486708", "KB4486688", "KB4486694", "KB4486676", "KB4484531", "KB4486687", "KB4486677", "KB4462175", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16953", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16941", "CVE-2020-16929"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16945", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941", "MS:CVE-2020-16944", "MS:CVE-2020-16950", "MS:CVE-2020-16948"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-19T12:03:14", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-19T12:03:14", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-19T12:03:14", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "164ae18711e5790c1c35480a25ae8274", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-16T23:55:23", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_EXCEL.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486688", "KB4486676", "KB4462175", "KB4486708", "KB4486677", "KB4486700", "KB4486694", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16944", "CVE-2020-16946", "CVE-2020-16952", "CVE-2020-16950"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16944", "MS:CVE-2020-16948", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16946", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-16T23:55:23", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-16T23:55:23", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-16T23:55:23", "differentElements": ["exploitEase"], "edition": 4}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112737", "hash": "f806d046897d70dd8d20bf5dbec18489", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2010 < 14.0.7261.5000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112737", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-23T00:02:13", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486676", "KB4462175", "KB4486708", "KB4486682", "KB4486688", "KB4486700", "KB4486677", "KB4486694"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16941", "CVE-2020-16952", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16944", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16953"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16948", "MS:CVE-2020-16941", "MS:CVE-2020-16953", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16950", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-23T00:02:13", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-23T00:02:13", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-23T00:02:13", "differentElements": ["cvssScoreSource"], "edition": 5}], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486674", "KB4486688", "KB4486677", "KB4486682", "KB4486687", "KB4486708", "KB4486700", "KB4486689", "KB4486678", "KB4486676", "KB4486707", "KB4486694", "KB4462175", "KB4486695"]}, {"type": "cve", "idList": ["CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16942", "CVE-2020-16948", "CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16951", "CVE-2020-16941"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16950", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16929", "MS:CVE-2020-16953", "MS:CVE-2020-16951", "MS:CVE-2020-16944", "MS:CVE-2020-16941", "MS:CVE-2020-16942", "MS:CVE-2020-16945", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-10-08T23:47:22", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-10-08T23:47:22", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112737", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2010 build 14.0.7261.5000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-16929", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.nessus.NessusBulletin", "robots.models.base.Bulletin"]}, {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "b4b762aaaa69c487aa23f1f58e171cb0", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-10-08T23:47:24", "history": [{"bulletin": {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "e271ec177ee63e692f60b672afbd8db6", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-05T12:49:29", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4486682", "KB4462175", "KB4486677", "KB4486694", "KB4486688", "KB4486708", "KB4486687", "KB4486700", "KB4484531", "KB4486676"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16953", "CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16941", "CVE-2020-16945", "CVE-2020-16952", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16929", "MS:CVE-2020-16941", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16951"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-05T12:49:29", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-08-05T12:49:29", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "Binary data WEB_APPLICATION_SCANNING_112739", "naslFamily": "Component Vulnerability", "cpe": [], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-05T12:49:29", "differentElements": ["cpe", "sourceData"], "edition": 1}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "9699177730df07c3505bcc125148ab17", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-06T13:25:22", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_EXCEL.NASL", "WEB_APPLICATION_SCANNING_112738", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4462175", "KB4484531", "KB4486677", "KB4486694", "KB4486687", "KB4486682", "KB4486676", "KB4486700", "KB4486708", "KB4486688"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16950", "CVE-2020-16952", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16948", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16950", "MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16945"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-06T13:25:22", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-06T13:25:22", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-06T13:25:22", "differentElements": ["nessusSeverity"], "edition": 2}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "e6a6a2e9abd5f4649f3b37004232bcf5", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-07-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-08-19T12:03:15", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "mskb", "idList": ["KB4486700", "KB4486708", "KB4486688", "KB4486694", "KB4486676", "KB4484531", "KB4486687", "KB4486677", "KB4462175", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16953", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16941", "CVE-2020-16929"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16945", "MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941", "MS:CVE-2020-16944", "MS:CVE-2020-16950", "MS:CVE-2020-16948"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-19T12:03:15", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-08-19T12:03:15", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-19T12:03:15", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "ef3299459b60c55857bacc7f266a4982", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-16T23:55:25", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486688", "KB4486676", "KB4462175", "KB4486708", "KB4486677", "KB4486700", "KB4486694", "KB4486682"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16944", "CVE-2020-16946", "CVE-2020-16952", "CVE-2020-16950"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16944", "MS:CVE-2020-16948", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16946", "MS:CVE-2020-16929", "MS:CVE-2020-16952", "MS:CVE-2020-16941"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-16T23:55:25", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-16T23:55:25", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-16T23:55:25", "differentElements": ["exploitEase"], "edition": 4}, {"bulletin": {"id": "WEB_APPLICATION_SCANNING_112739", "hash": "7ac1d15eaeae4e61e40f41a50c106a8a", "type": "nessus", "bulletinFamily": "scanner", "title": "Microsoft SharePoint Server 2016 < 16.0.5071.1000 Multiple Vulnerabilities", "description": "According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities :\n\n - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory.\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory.\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages.\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "published": "2021-04-01T00:00:00", "modified": "2021-09-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/was/112739", "reporter": "This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16952", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16951", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16929", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16929"], "cvelist": ["CVE-2020-16929", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16948", "CVE-2020-16941", "CVE-2020-16946", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16942"], "immutableFields": [], "lastseen": "2021-09-23T00:02:15", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL", "SMB_NT_MS20_OCT_EXCEL.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486687", "KB4486676", "KB4462175", "KB4486708", "KB4486682", "KB4486688", "KB4486700", "KB4486677", "KB4486694"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16941", "CVE-2020-16952", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16944", "CVE-2020-16929", "CVE-2020-16945", "CVE-2020-16953"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16929", "MS:CVE-2020-16948", "MS:CVE-2020-16941", "MS:CVE-2020-16953", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16951", "MS:CVE-2020-16950", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-09-23T00:02:15", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-09-23T00:02:15", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-23T00:02:15", "differentElements": ["cvssScoreSource"], "edition": 5}], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_EXCEL.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "MACOS_MS20_OCT_OFFICE.NASL", "SMB_NT_MS20_OCT_OFFICE_WEB.NASL"]}, {"type": "mskb", "idList": ["KB4484531", "KB4486674", "KB4486688", "KB4486677", "KB4486682", "KB4486687", "KB4486708", "KB4486700", "KB4486689", "KB4486678", "KB4486676", "KB4486707", "KB4486694", "KB4462175", "KB4486695"]}, {"type": "cve", "idList": ["CVE-2020-16950", "CVE-2020-16929", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16942", "CVE-2020-16948", "CVE-2020-16945", "CVE-2020-16953", "CVE-2020-16952", "CVE-2020-16951", "CVE-2020-16941"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16950", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16929", "MS:CVE-2020-16953", "MS:CVE-2020-16951", "MS:CVE-2020-16944", "MS:CVE-2020-16941", "MS:CVE-2020-16942", "MS:CVE-2020-16945", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "zdi", "idList": ["ZDI-20-1251"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-10-08T23:47:24", "rev": 2}, "score": {"value": 5.7, "vector": "NONE", "modified": "2021-10-08T23:47:24", "rev": 2}}, "objectVersion": "1.6", "pluginID": "112739", "sourceData": "No source data", "naslFamily": "Component Vulnerability", "cpe": ["cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Microsoft SharePoint Server 2016 build 16.0.5071.1000 or later.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-16929", "vpr": {}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2020-10-16T00:00:00", "vulnerabilityPublicationDate": "2020-10-16T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.nessus.NessusBulletin", "robots.models.base.Bulletin"]}, {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "5c5394ad5ce64a82cbe7870f42c89140", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2020-16948, CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability. The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions, delete content, steal sensitive information (such as browser cookies) and inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted SharePoint Web App site. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted SharePoint Web App site and convincing the user to click the specially crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2020-16945, CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2021-01-28T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "https://support.microsoft.com/en-us/help/4486676", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950"], "cvelist": ["CVE-2020-16941", "CVE-2020-16942", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16946", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16953"], "immutableFields": [], "lastseen": "2021-08-19T12:12:35", "history": [{"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "1338d67f9d330d777e9ba6249433b3475e6d6400e39700c483fef461afaa9019", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 9.7, "vector": "AV:N/AC:L/Au:N/C:P/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 8.6, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2020-10-14T18:04:08", "history": [], "viewCount": 3, "enchantments": {"dependencies": {"modified": "2020-10-14T18:04:08", "references": [{"idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16942", "MS:CVE-2020-16948", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16945", "MS:CVE-2020-16944", "MS:CVE-2020-16946"], "type": "mscve"}, {"idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"], "type": "rapid7blog"}, {"idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"], "type": "qualysblog"}, {"idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"], "type": "threatpost"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"], "type": "nessus"}], "rev": 2}, "score": {"modified": "2020-10-14T18:04:08", "rev": 2, "value": 0.3, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.1\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/13\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\n\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16951\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\",\"smb_hotfixes.nasl\",\"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2020-10-14T18:04:08", "differentElements": ["sourceData"], "edition": 1}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "08121ed00d03d21443c0169895fc83ecbe41241100fac73b6da98f56d34c6bc5", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 9.7, "vector": "AV:N/AC:L/Au:N/C:P/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 8.6, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2020-10-17T09:46:54", "history": [], "viewCount": 8, "enchantments": {"dependencies": {"modified": "2020-10-17T09:46:54", "references": [{"idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16942", "MS:CVE-2020-16948", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16945", "MS:CVE-2020-16944", "MS:CVE-2020-16946"], "type": "mscve"}, {"idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"], "type": "rapid7blog"}, {"idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"], "type": "qualysblog"}, {"idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"], "type": "threatpost"}, {"idList": ["PACKETSTORM:159612"], "type": "packetstorm"}, {"idList": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "type": "cve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-17T09:46:54", "rev": 2, "value": 5.2, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/16\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16951\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2020-10-17T09:46:54", "differentElements": ["sourceData"], "edition": 2}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "2c1fbb6d4de4ceb18b542b1cdfc5fbce431575eb51edc40cc840cbad7c415061", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 9.7, "vector": "AV:N/AC:L/Au:N/C:P/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 8.6, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2020-10-21T09:34:41", "history": [], "viewCount": 9, "enchantments": {"dependencies": {"modified": "2020-10-21T09:34:41", "references": [{"idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16942", "MS:CVE-2020-16948", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16945", "MS:CVE-2020-16944", "MS:CVE-2020-16946"], "type": "mscve"}, {"idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"], "type": "qualysblog"}, {"idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"], "type": "threatpost"}, {"idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"], "type": "rapid7blog"}, {"idList": ["PACKETSTORM:159612"], "type": "packetstorm"}, {"idList": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "type": "cve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-21T09:34:41", "rev": 2, "value": 5.2, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/10/20\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16951\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_hole();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2020-10-21T09:34:41", "differentElements": ["cvss", "cvss3", "sourceData"], "edition": 3}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "6a027033ef74bcf5e802640c520eea6949ab2e8ef0d2a1089bab38d711b1e12a", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2020-11-15T06:24:38", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"modified": "2020-11-15T06:24:38", "references": [{"idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16942", "MS:CVE-2020-16948", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16945", "MS:CVE-2020-16944", "MS:CVE-2020-16946"], "type": "mscve"}, {"idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"], "type": "qualysblog"}, {"idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"], "type": "threatpost"}, {"idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"], "type": "rapid7blog"}, {"idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"], "type": "attackerkb"}, {"idList": ["PACKETSTORM:159612"], "type": "packetstorm"}, {"idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"], "type": "cisa"}, {"idList": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "type": "cve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2020-11-15T06:24:38", "rev": 2, "value": 5.2, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/13\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2020-11-15T06:24:38", "differentElements": ["cpe", "reporter", "sourceData"], "edition": 4}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "01338db4a79191c8af0f32e2c88de892350367b68026b0d50d19c4d69031f159", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2021-01-29T13:44:36", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"modified": "2021-01-29T13:44:36", "references": [{"idList": ["MS:CVE-2020-16951", "MS:CVE-2020-16952", "MS:CVE-2020-16942", "MS:CVE-2020-16948", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16945", "MS:CVE-2020-16944", "MS:CVE-2020-16946"], "type": "mscve"}, {"idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"], "type": "qualysblog"}, {"idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"], "type": "threatpost"}, {"idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"], "type": "avleonov"}, {"idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"], "type": "rapid7blog"}, {"idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"], "type": "attackerkb"}, {"idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"], "type": "metasploit"}, {"idList": ["PACKETSTORM:159612"], "type": "packetstorm"}, {"idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"], "type": "cisa"}, {"idList": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "type": "cve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-01-29T13:44:36", "rev": 2, "value": 4.4, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint_server", "cpe:/a:microsoft:sharepoint_foundation"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2021-01-29T13:44:36", "differentElements": ["cvss2", "cvss3"], "edition": 5}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "ab0601bd529afebadb2209ca78cd27fa", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2020-10-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.microsoft.com/en-us/help/4486676"], "cvelist": ["CVE-2020-16941", "CVE-2020-16951", "CVE-2020-16945", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16952"], "immutableFields": [], "lastseen": "2021-07-29T03:54:46", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL"]}, {"type": "cve", "idList": ["CVE-2020-16952", "CVE-2020-16950", "CVE-2020-16942", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16945", "CVE-2020-16944", "CVE-2020-16946", "CVE-2020-16941", "CVE-2020-16951"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16941", "MS:CVE-2020-16946", "MS:CVE-2020-16945", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16942", "MS:CVE-2020-16951", "MS:CVE-2020-16950", "MS:CVE-2020-16948", "MS:CVE-2020-16953"]}, {"type": "mskb", "idList": ["KB4486708", "KB4486677", "KB4486694", "KB4486676"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-07-29T03:54:46", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-07-29T03:54:46", "rev": 2}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint_server", "cpe:/a:microsoft:sharepoint_foundation"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2021-07-29T03:54:46", "differentElements": ["cpe", "cvss2", "cvss3", "cvssScoreSource", "description", "exploitAvailable", "exploitEase", "exploitableWith", "modified", "patchPublicationDate", "references", "solution", "vpr", "vulnerabilityPublicationDate"], "edition": 6}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "57e80cb855bc83eb09b234cdd820e50e", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2020-16948, CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability. The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions, delete content, steal sensitive information (such as browser cookies) and inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted SharePoint Web App site. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted SharePoint Web App site and convincing the user to click the specially crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2020-16945, CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2021-01-28T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "https://support.microsoft.com/en-us/help/4486676", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944"], "cvelist": ["CVE-2020-16941", "CVE-2020-16942", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16946", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16953"], "immutableFields": [], "lastseen": "2021-08-05T12:58:07", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "mskb", "idList": ["KB4486708", "KB4486694", "KB4486677", "KB4486676"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "cve", "idList": ["CVE-2020-16946", "CVE-2020-16951", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16953", "CVE-2020-16941", "CVE-2020-16945", "CVE-2020-16942", "CVE-2020-16952", "CVE-2020-16944"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D", "RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16946", "MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16942", "MS:CVE-2020-16941", "MS:CVE-2020-16952", "MS:CVE-2020-16948", "MS:CVE-2020-16951"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-05T12:58:07", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-08-05T12:58:07", "rev": 2}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": [], "solution": "Microsoft has released KB4486676 to address this issue.", "nessusSeverity": "", "cvssScoreSource": "CVE-2020-16952", "vpr": {"risk factor": "High", "score": "8.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2020-10-13T00:00:00", "vulnerabilityPublicationDate": "2020-10-13T00:00:00", "exploitableWith": ["Metasploit: Microsoft SharePoint Server-Side Include and ViewState RCE"]}, "lastseen": "2021-08-05T12:58:07", "differentElements": ["cpe"], "edition": 7}, {"bulletin": {"id": "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "hash": "484e503f3e1d83fa5dc893741ca78aaa", "type": "nessus", "bulletinFamily": "scanner", "title": "Security Updates for Microsoft SharePoint Server 2019 (October 2020)", "description": "The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2020-16948, CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages. An attacker who took advantage of this information disclosure could view the folder path of scripts loaded on the page. To take advantage of the vulnerability, an attacker would require access to the specific SharePoint page affected by this vulnerability. The security update addresses the vulnerability by correcting how scripts are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. The security update addresses the vulnerability by correcting how SharePoint checks the source markup of application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions, delete content, steal sensitive information (such as browser cookies) and inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted SharePoint Web App site. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted SharePoint Web App site and convincing the user to click the specially crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user. The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests. (CVE-2020-16945, CVE-2020-16946)", "published": "2020-10-13T00:00:00", "modified": "2021-01-28T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/141419", "reporter": "This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16941", "https://support.microsoft.com/en-us/help/4486676", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16953", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16946", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16950", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16944", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16942", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16952", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16945", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16951", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16948"], "cvelist": ["CVE-2020-16941", "CVE-2020-16942", "CVE-2020-16944", "CVE-2020-16945", "CVE-2020-16946", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16952", "CVE-2020-16953"], "immutableFields": [], "lastseen": "2021-08-06T13:33:53", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "mskb", "idList": ["KB4486708", "KB4486677", "KB4486676", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16942", "CVE-2020-16941", "CVE-2020-16952", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16950", "CVE-2020-16951", "CVE-2020-16953", "CVE-2020-16948"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16953", "MS:CVE-2020-16946", "MS:CVE-2020-16951", "MS:CVE-2020-16944", "MS:CVE-2020-16952", "MS:CVE-2020-16945", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16942"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-06T13:33:53", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-08-06T13:33:53", "rev": 2}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint_foundation", "cpe:/a:microsoft:sharepoint_server"], "solution": "Microsoft has released KB4486676 to address this issue.", "nessusSeverity": "", "cvssScoreSource": "CVE-2020-16952", "vpr": {"risk factor": "High", "score": "8.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2020-10-13T00:00:00", "vulnerabilityPublicationDate": "2020-10-13T00:00:00", "exploitableWith": ["Metasploit: Microsoft SharePoint Server-Side Include and ViewState RCE"]}, "lastseen": "2021-08-06T13:33:53", "differentElements": ["exploitableWith", "nessusSeverity"], "edition": 8}], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "mskb", "idList": ["KB4486677", "KB4486708", "KB4486676", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "cve", "idList": ["CVE-2020-16945", "CVE-2020-16942", "CVE-2020-16951", "CVE-2020-16946", "CVE-2020-16944", "CVE-2020-16953", "CVE-2020-16948", "CVE-2020-16950", "CVE-2020-16952", "CVE-2020-16941"]}, {"type": "attackerkb", "idList": ["AKB:E6BD4207-BAC0-40E1-A4C8-92B6D3D58D4B"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/MSFT-CVE-2020-16951/"]}, {"type": "kaspersky", "idList": ["KLA11976"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:801DC63ED24DFFC38FE4775AAD07ADDB", "RAPID7BLOG:E8EB68630D38C60B7DE4AF696474210D"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:9E7466695714D29E4314F63F45A74EB3"]}, {"type": "mscve", "idList": ["MS:CVE-2020-16953", "MS:CVE-2020-16950", "MS:CVE-2020-16941", "MS:CVE-2020-16948", "MS:CVE-2020-16951", "MS:CVE-2020-16942", "MS:CVE-2020-16952", "MS:CVE-2020-16944", "MS:CVE-2020-16945", "MS:CVE-2020-16946"]}, {"type": "cisa", "idList": ["CISA:48962A3B37B032DCF622B3E3135B8A1A"]}, {"type": "zdt", "idList": ["1337DAY-ID-35071"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:159612"]}, {"type": "threatpost", "idList": ["THREATPOST:779B904F971138531725D1E57FDFF9DD"]}, {"type": "avleonov", "idList": ["AVLEONOV:28E47C69DA4A069031694EB4C2C931BA"]}], "modified": "2021-08-19T12:12:35", "rev": 2}, "score": {"value": 4.3, "vector": "NONE", "modified": "2021-08-19T12:12:35", "rev": 2}}, "objectVersion": "1.6", "pluginID": "141419", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the Microsoft Security Updates API. The text\n# itself is copyright (C) Microsoft Corporation.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141419);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2020-16941\",\n \"CVE-2020-16942\",\n \"CVE-2020-16944\",\n \"CVE-2020-16945\",\n \"CVE-2020-16946\",\n \"CVE-2020-16948\",\n \"CVE-2020-16950\",\n \"CVE-2020-16951\",\n \"CVE-2020-16952\",\n \"CVE-2020-16953\"\n );\n script_xref(name:\"MSKB\", value:\"4486676\");\n script_xref(name:\"MSFT\", value:\"MS20-4486676\");\n script_xref(name:\"IAVA\", value:\"2020-A-0460-S\");\n\n script_name(english:\"Security Updates for Microsoft SharePoint Server 2019 (October 2020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The Microsoft SharePoint Server 2019 installation on the remote host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The Microsoft SharePoint Server 2019 installation on the\nremote host is missing security updates. It is, therefore,\naffected by multiple vulnerabilities :\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server fails to properly handle\n objects in memory. An attacker who successfully\n exploited this vulnerability could obtain information to\n further compromise the users system. (CVE-2020-16948,\n CVE-2020-16950, CVE-2020-16953)\n\n - An information disclosure vulnerability exists when\n Microsoft SharePoint Server improperly discloses its\n folder structure when rendering specific web pages. An\n attacker who took advantage of this information\n disclosure could view the folder path of scripts loaded\n on the page. To take advantage of the vulnerability, an\n attacker would require access to the specific SharePoint\n page affected by this vulnerability. The security update\n addresses the vulnerability by correcting how scripts\n are referenced on some SharePoint pages.\n (CVE-2020-16941, CVE-2020-16942)\n\n - A remote code execution vulnerability exists in\n Microsoft SharePoint when the software fails to check\n the source markup of an application package. An attacker\n who successfully exploited the vulnerability could run\n arbitrary code in the context of the SharePoint\n application pool and the SharePoint server farm account.\n Exploitation of this vulnerability requires that a user\n uploads a specially crafted SharePoint application\n package to an affected version of SharePoint. The\n security update addresses the vulnerability by\n correcting how SharePoint checks the source markup of\n application packages. (CVE-2020-16951, CVE-2020-16952)\n\n - This vulnerability is caused when SharePoint Server does\n not properly sanitize a specially crafted request to an\n affected SharePoint server. An authenticated attacker\n could exploit this vulnerability by sending a specially\n crafted request to an affected SharePoint server. The\n attacker who successfully exploited this vulnerability\n could then perform cross-site scripting attacks on\n affected systems and run script in the security context\n of the current user. These attacks could allow the\n attacker to read content that the attacker is not\n authorized to read, use the victim's identity to take\n actions on the SharePoint site on behalf of the victim,\n such as change permissions, delete content, steal\n sensitive information (such as browser cookies) and\n inject malicious content in the browser of the victim.\n For this vulnerability to be exploited, a user must\n click a specially crafted URL that takes the user to a\n targeted SharePoint Web App site. In an email attack\n scenario, an attacker could exploit the vulnerability by\n sending an email message containing the specially\n crafted URL to the user of the targeted SharePoint Web\n App site and convincing the user to click the specially\n crafted URL. (CVE-2020-16944)\n\n - A cross-site-scripting (XSS) vulnerability exists when\n Microsoft SharePoint Server does not properly sanitize a\n specially crafted web request to an affected SharePoint\n server. An authenticated attacker could exploit the\n vulnerability by sending a specially crafted request to\n an affected SharePoint server. The attacker who\n successfully exploited the vulnerability could then\n perform cross-site scripting attacks on affected systems\n and run script in the security context of the current\n user. The attacks could allow the attacker to read\n content that the attacker is not authorized to read, use\n the victim's identity to take actions on the SharePoint\n site on behalf of the user, such as change permissions\n and delete content, and inject malicious content in the\n browser of the user. The security update addresses the\n vulnerability by helping to ensure that SharePoint\n Server properly sanitizes web requests. (CVE-2020-16945,\n CVE-2020-16946)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.microsoft.com/en-us/help/4486676\");\n script_set_attribute(attribute:\"solution\", value:\n\"Microsoft has released KB4486676 to address this issue.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-16952\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Microsoft SharePoint Server-Side Include and ViewState RCE');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_foundation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:microsoft:sharepoint_server\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows : Microsoft Bulletins\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"microsoft_sharepoint_installed.nbin\", \"smb_hotfixes.nasl\", \"ms_bulletin_checks_possible.nasl\");\n script_require_keys(\"SMB/MS_Bulletin_Checks/Possible\");\n script_require_ports(139, 445, \"Host/patch_management_checks\");\n\n exit(0);\n}\n\ninclude('smb_func.inc');\ninclude('smb_hotfixes.inc');\ninclude('smb_hotfixes_fcheck.inc');\ninclude('smb_reg_query.inc');\ninclude('misc_func.inc');\ninclude('install_func.inc');\ninclude('lists.inc');\n\nget_kb_item_or_exit('SMB/MS_Bulletin_Checks/Possible');\n\nbulletin = 'MS20-10';\n\nkbs = make_list(\n '4486676'\n);\n\nif (get_kb_item('Host/patch_management_checks'))\n hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);\n\nget_kb_item_or_exit('SMB/Registry/Enumerated', exit_code:1);\n\n# Get path information for Windows.\nwindir = hotfix_get_systemroot();\nif (isnull(windir)) exit(1, 'Failed to determine the location of %windir%.');\n\nregistry_init();\n\ninstall = get_single_install(app_name:'Microsoft SharePoint Server');\n\nkb_checks =\n{\n '2019':\n { '0':\n {'Server':\n [{\n 'kb' : '4486676',\n 'path' : install['path'],\n 'append' : 'bin',\n 'file' : 'ascalc.dll',\n 'version' : '16.0.10367.20000',\n 'product_name' : 'Microsoft SharePoint Server 2019'\n }]\n }\n }\n};\n\n# Get the specific product / path \nparam_list = kb_checks[install['Product']][install['SP']][install['Edition']];\n\n# audit if not affected\nif(isnull(param_list)) audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft SharePoint Server');\n\n\nvuln = FALSE;\nxss = FALSE;\nport = kb_smb_transport();\n\n# grab the path otherwise\nforeach check (param_list)\n{\n \n if (!isnull(check['version']))\n {\n path = hotfix_append_path(path:check['path'], value:check['append']);\n\n are_we_vuln = hotfix_check_fversion(\n file:check['file'],\n version:check['version'],\n path:path,\n kb:check['kb'],\n product:check['product_name']\n );\n }\n else\n {\n report = '\\n';\n\n if (check['product_name'])\n report += ' Product : ' + check['product_name'] + '\\n';\n if (check['kb'])\n report += ' KB : ' + check['kb'] + '\\n';\n hotfix_add_report(report, kb:check['kb']);\n }\n\n if(are_we_vuln == HCF_OLDER)\n {\n vuln = TRUE;\n if (check['kb'] == '4486676') xss = TRUE;\n }\n}\n\nif (vuln)\n{\n port = kb_smb_transport();\n replace_kb_item(name:'SMB/Missing/'+bulletin, value:TRUE);\n if (xss) replace_kb_item(name:'www/' + port + '/XSS', value:TRUE);\n hotfix_security_warning();\n hotfix_check_fversion_end();\n exit(0);\n}\nelse\n{\n hotfix_check_fversion_end();\n audit(AUDIT_HOST_NOT, 'affected');\n}\n\n\n", "naslFamily": "Windows : Microsoft Bulletins", "cpe": ["cpe:/a:microsoft:sharepoint_foundation", "cpe:/a:microsoft:sharepoint_server"], "solution": "Microsoft has released KB4486676 to address this issue.", "nessusSeverity": "Medium", "cvssScoreSource": "CVE-2020-16952", "vpr": {"risk factor": "High", "score": "8.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2020-10-13T00:00:00", "vulnerabilityPublicationDate": "2020-10-13T00:00:00", "exploitableWith": ["Metasploit(Microsoft SharePoint Server-Side Include and ViewState RCE)"], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.nessus.NessusBulletin"]}], "rst": [{"id": "RST:93F9801C-42C5-3098-9AF3-49841BD85759", "bulletinFamily": "ioc", "title": "RST Threat feed. IOC: sf-2007.official-org.com/c/p/tc/16950/af8b9441-d6bb-45d3-a115-dc90b7eb71d6-809ec939-d1aa-4bfa-9971-202b43c40a73", "description": "Found **sf-2007[.]official-org.com/c/p/tc/16950/af8b9441-d6bb-45d3-a115-dc90b7eb71d6-809ec939-d1aa-4bfa-9971-202b43c40a73** in [RST Threat Feed](https://rstcloud.net/profeed) with score **18**.\n First seen: 2020-11-03T03:00:00, Last seen: 2020-11-04T03:00:00.\n IOC tags: **phishing**.\nIOC could be a **False Positive** (Resource unavailable).\n[https://rstcloud.net/](https://rstcloud.net/)", "published": "2020-11-05T00:00:00", "modified": "2020-11-03T00:00:00", "cvss": {}, "href": "", "reporter": "RST Threat Feed", "references": [], "cvelist": [], "type": "rst", "lastseen": "2020-11-04T00:00:00", "history": [], "edition": 1, "hashmap": [{"key": "asn", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "e03daa7651c34372b0bf8c442bb00813"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "description", "hash": "fd2aabe7ce455e067ddeff5415a5a67f"}, {"key": "domain", "hash": "b4e2551c30c8729dac6fe5f9dac4acce"}, {"key": "fp", "hash": "fa606d49ea7798d3fe8c2c48edbac9a5"}, {"key": "geodata", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "iocScore", "hash": "cc3596fedbcee8adbe1a340edfb519a9"}, {"key": "iocType", "hash": "572d4e421e5e6b9bc11d815e8a027112"}, {"key": "ip", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "bf7b190bd0628075759cca9329c8edc7"}, {"key": "published", "hash": "cf085eb93705dcfb13757e16624f1560"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "ecfdd35b9632d35ab17dbe9c46491f14"}, {"key": "tags", "hash": "1ce4383d8816542878fa583f9d13e8a4"}, {"key": "threat", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "247e2adefce8d54a53c7c1e352e18332"}, {"key": "type", "hash": "d674dfcd8b4db6762bcb3667316d3bb9"}, {"key": "url", "hash": "bc955a7a125b178c143092de5fdba8f7"}, {"key": "whois", "hash": "d41d8cd98f00b204e9800998ecf8427e"}], "hash": "22481acf4338be30eea52207b6d75b8822a7bc4d828d2f44b2d2135e009a9f25", "viewCount": 0, "enchantments": {}, "objectVersion": "1.3", "iocType": "url", "ip": [], "domain": ["sf-2007.official-org.com"], "url": ["sf-2007.official-org.com/c/p/tc/16950/af8b9441-d6bb-45d3-a115-dc90b7eb71d6-809ec939-d1aa-4bfa-9971-202b43c40a73"], "iocScore": {"ioc_frequency": 0.98, "ioc_src": 74.99, "ioc_tags": 0.83, "ioc_total": 18.0}, "tags": ["phishing"], "fp": {"alarm": "true", "descr": "Resource unavailable"}, "whois": {}, "geodata": {}, "asn": {}, "threat": []}], "cve": [{"id": "CVE-2020-16953", "bulletinFamily": "NVD", "title": "CVE-2020-16953", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "published": "2020-10-16T23:15:00", "modified": "2021-07-21T11:39:00", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "cvelist": ["CVE-2020-16953"], "type": "cve", "lastseen": "2021-08-04T16:55:08", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2010"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_server:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16953"], "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-02-02T07:37:01", "references": [{"idList": ["MS:CVE-2020-16953"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-02-02T07:37:01", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"}], "hash": "5b4fe6d5f6fdbb2bc548a4833c09f035fd77ef96bac01e9f1b828a80bfbc5228", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "e32792bd2ad39d67f133e085a06c7735", "key": "cpe23"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "07a69fb94693e6a2da876529ddd1e0ec", "key": "cvss2"}, {"hash": "843896e6f4ab3eb8003c2da84017d603", "key": "title"}, {"hash": "2ed62d9088cb273b146379c0399754e9", "key": "modified"}, {"hash": "43d871a45814c309fac3d1401b9fef90", "key": "extraReferences"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "55374e6b79c3a9af7cee3a8534c04269", "key": "description"}, {"hash": "b60539346529a8ce5afecee51ddd8985", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "86a7df91bece54f7e3c71db9f3e9b28d", "key": "affectedSoftware"}, {"hash": "e8d0af68bb102357c1a66383d1243ed9", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "2f1c6000379c94230a9f060a25aba969", "key": "cpe"}, {"hash": "8adad9680246d85bf3e31a7a0a8eeba9", "key": "cpeConfiguration"}, {"hash": "e258b79b31d39a327c9dafeb61b7a729", "key": "cvss"}, {"hash": "d0fd0fddf104e086e6ff4877105b8ee0", "key": "cvelist"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "0a652102b5dbe05e843a3d053c6533a9", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "id": "CVE-2020-16953", "immutableFields": [], "lastseen": "2021-02-02T07:37:01", "modified": "2020-10-20T14:35:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "reporter": "cve@mitre.org", "title": "CVE-2020-16953", "type": "cve", "viewCount": 31}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 4, "lastseen": "2021-02-02T07:37:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16953"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-10-20T11:10:53", "references": [{"idList": ["MS:CVE-2020-16953"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-20T11:10:53", "rev": 2, "value": 1.9, "vector": "NONE"}}, "hash": "acab2a6b7fc27f1fe83ed17ad4d975e4f17e6a8cc0f4345a5df0a03a8ed07290", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "843896e6f4ab3eb8003c2da84017d603", "key": "title"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "55374e6b79c3a9af7cee3a8534c04269", "key": "description"}, {"hash": "b60539346529a8ce5afecee51ddd8985", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "c2446defffc859bf0498b825967541c5", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "d0fd0fddf104e086e6ff4877105b8ee0", "key": "cvelist"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "0a652102b5dbe05e843a3d053c6533a9", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "id": "CVE-2020-16953", "lastseen": "2020-10-20T11:10:53", "modified": "2020-10-19T11:42:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "reporter": "cve@mitre.org", "title": "CVE-2020-16953", "type": "cve", "viewCount": 17}, "differentElements": ["cpe23", "cvss", "cvss3", "cvss2", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 2, "lastseen": "2020-10-20T11:10:53"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2010"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_server:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16953"], "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-21T11:10:18", "references": [{"idList": ["MS:CVE-2020-16953"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2020-10-21T11:10:18", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [], "hash": "52b4680b50755119cf9a997e5fdd59a363c636d1cf458dcde0496fd3892c4481", "hashmap": [{"hash": "e32792bd2ad39d67f133e085a06c7735", "key": "cpe23"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "07a69fb94693e6a2da876529ddd1e0ec", "key": "cvss2"}, {"hash": "843896e6f4ab3eb8003c2da84017d603", "key": "title"}, {"hash": "2ed62d9088cb273b146379c0399754e9", "key": "modified"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "55374e6b79c3a9af7cee3a8534c04269", "key": "description"}, {"hash": "b60539346529a8ce5afecee51ddd8985", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "86a7df91bece54f7e3c71db9f3e9b28d", "key": "affectedSoftware"}, {"hash": "e8d0af68bb102357c1a66383d1243ed9", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "2f1c6000379c94230a9f060a25aba969", "key": "cpe"}, {"hash": "8adad9680246d85bf3e31a7a0a8eeba9", "key": "cpeConfiguration"}, {"hash": "e258b79b31d39a327c9dafeb61b7a729", "key": "cvss"}, {"hash": "d0fd0fddf104e086e6ff4877105b8ee0", "key": "cvelist"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "0a652102b5dbe05e843a3d053c6533a9", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "id": "CVE-2020-16953", "lastseen": "2020-10-21T11:10:18", "modified": "2020-10-20T14:35:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "reporter": "cve@mitre.org", "title": "CVE-2020-16953", "type": "cve", "viewCount": 30}, "differentElements": ["extraReferences"], "edition": 3, "lastseen": "2020-10-21T11:10:18"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2010"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_server:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16953"], "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "edition": 6, "enchantments": {"dependencies": {"modified": "2021-07-22T08:54:28", "references": [{"idList": ["MS:CVE-2020-16953"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-07-22T08:54:28", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"}], "hash": "f64a0d27bbd1a3bda40ef18979fe9623f3bb4de2119fe5c97a0b104466a408f6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "e32792bd2ad39d67f133e085a06c7735", "key": "cpe23"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "07a69fb94693e6a2da876529ddd1e0ec", "key": "cvss2"}, {"hash": "843896e6f4ab3eb8003c2da84017d603", "key": "title"}, {"hash": "43d871a45814c309fac3d1401b9fef90", "key": "extraReferences"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "55374e6b79c3a9af7cee3a8534c04269", "key": "description"}, {"hash": "b60539346529a8ce5afecee51ddd8985", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "d56f84cbc6056d9c9a9a752bfcb49488", "key": "cpeConfiguration"}, {"hash": "86a7df91bece54f7e3c71db9f3e9b28d", "key": "affectedSoftware"}, {"hash": "e8d0af68bb102357c1a66383d1243ed9", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "2f1c6000379c94230a9f060a25aba969", "key": "cpe"}, {"hash": "e258b79b31d39a327c9dafeb61b7a729", "key": "cvss"}, {"hash": "d0fd0fddf104e086e6ff4877105b8ee0", "key": "cvelist"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "183798fce373747341ba2f32f8021ac7", "key": "modified"}, {"hash": "0a652102b5dbe05e843a3d053c6533a9", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "id": "CVE-2020-16953", "immutableFields": [], "lastseen": "2021-07-22T08:54:28", "modified": "2021-07-21T11:39:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16953", "type": "cve", "viewCount": 36}, "different_elements": ["cwe"], "edition": 6, "lastseen": "2021-07-22T08:54:28"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16953"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-10-17T11:07:32", "references": [{"idList": ["MS:CVE-2020-16953"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}], "rev": 2}, "score": {"modified": "2020-10-17T11:07:32", "rev": 2, "value": 1.6, "vector": "NONE"}}, "hash": "f06934e39edc73b1e5a3566a6ae383abb2b104878918be415dad21d2004792c1", "hashmap": [{"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "843896e6f4ab3eb8003c2da84017d603", "key": "title"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "55374e6b79c3a9af7cee3a8534c04269", "key": "description"}, {"hash": "b60539346529a8ce5afecee51ddd8985", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "d0fd0fddf104e086e6ff4877105b8ee0", "key": "cvelist"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "0a652102b5dbe05e843a3d053c6533a9", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16953", "id": "CVE-2020-16953", "lastseen": "2020-10-17T11:07:32", "modified": "2020-10-16T23:15:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"], "reporter": "cve@mitre.org", "title": "CVE-2020-16953", "type": "cve", "viewCount": 17}, "differentElements": ["modified"], "edition": 1, "lastseen": "2020-10-17T11:07:32"}], "edition": 7, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "86a7df91bece54f7e3c71db9f3e9b28d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "2f1c6000379c94230a9f060a25aba969"}, {"key": "cpe23", "hash": "e32792bd2ad39d67f133e085a06c7735"}, {"key": "cpeConfiguration", "hash": "d56f84cbc6056d9c9a9a752bfcb49488"}, {"key": "cvelist", "hash": "d0fd0fddf104e086e6ff4877105b8ee0"}, {"key": "cvss", "hash": "e258b79b31d39a327c9dafeb61b7a729"}, {"key": "cvss2", "hash": "07a69fb94693e6a2da876529ddd1e0ec"}, {"key": "cvss3", "hash": "e8d0af68bb102357c1a66383d1243ed9"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "55374e6b79c3a9af7cee3a8534c04269"}, {"key": "extraReferences", "hash": "43d871a45814c309fac3d1401b9fef90"}, {"key": "href", "hash": "b60539346529a8ce5afecee51ddd8985"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "183798fce373747341ba2f32f8021ac7"}, {"key": "published", "hash": "ccdbc538dd5b4d39f6035c206ec1fa15"}, {"key": "references", "hash": "0a652102b5dbe05e843a3d053c6533a9"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "843896e6f4ab3eb8003c2da84017d603"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "c27c4639b1401a3977c3f637775b802a7f743242549f6b124409a7bd0e3b1d96", "viewCount": 63, "enchantments": {"dependencies": {"references": [{"type": "mscve", "idList": ["MS:CVE-2020-16953"]}, {"type": "mskb", "idList": ["KB4486676", "KB4486708", "KB4486677", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-08-04T16:55:08", "rev": 2}, "score": {"value": 1.9, "vector": "NONE", "modified": "2021-08-04T16:55:08", "rev": 2}}, "objectVersion": "1.6", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_server:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2010"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16953"}], "immutableFields": []}, {"id": "CVE-2020-16950", "bulletinFamily": "NVD", "title": "CVE-2020-16950", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "published": "2020-10-16T23:15:00", "modified": "2021-07-21T11:39:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "cvelist": ["CVE-2020-16950"], "type": "cve", "lastseen": "2021-08-04T16:55:08", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_server:2019"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "edition": 6, "enchantments": {"dependencies": {"modified": "2021-07-22T08:54:28", "references": [{"idList": ["MS:CVE-2020-16950"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KB4486676"], "type": "mskb"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2021-07-22T08:54:28", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"}], "hash": "70db33c1703cd74306253e18cd9a9d96e26104fd238f3616634b63bfdf24b013", "hashmap": [{"hash": "434669adc8d0504de64471dd6747c2c7", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "1e5c655863833a3cee72c32615f22eea", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "fc8e4a79cf0d59239b0c38a00077be9c", "key": "extraReferences"}, {"hash": "a89f01bde8c28c5ef880a8e031c8abc9", "key": "cvss3"}, {"hash": "f2747c81ae180ef120431e6b557fe202", "key": "cvelist"}, {"hash": "c0109a7a7623f17fc90435167ea606f4", "key": "cpe23"}, {"hash": "16b533ac1ca3f853b12fda5415a759ca", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "faab7597486b38363731adfe8b01a307", "key": "description"}, {"hash": "aae19cc71ef4568916460e41c6f1d931", "key": "cpe"}, {"hash": "07328335863c93f7825c07c2d14e1d32", "key": "affectedSoftware"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "cb88f326ecdc38e546d7620cb71542d8", "key": "cpeConfiguration"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "876f47c4ebc2b9e0dd17afaa22819f2a", "key": "cvss"}, {"hash": "7c890ef3388c97062835b70e4d7f0cd7", "key": "title"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "183798fce373747341ba2f32f8021ac7", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "id": "CVE-2020-16950", "immutableFields": [], "lastseen": "2021-07-22T08:54:28", "modified": "2021-07-21T11:39:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16950", "type": "cve", "viewCount": 15}, "different_elements": ["cwe"], "edition": 6, "lastseen": "2021-07-22T08:54:28"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_server:2019"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-02-02T07:37:01", "references": [{"idList": ["MS:CVE-2020-16950"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KB4486676"], "type": "mskb"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2021-02-02T07:37:01", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"}], "hash": "3ec4e1517f2a304447fb873fb1fcc521279f8f68862ee496747485a53b97cdbb", "hashmap": [{"hash": "434669adc8d0504de64471dd6747c2c7", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "27b2a2b39d9a237a62c08924e3bc5cde", "key": "modified"}, {"hash": "1e5c655863833a3cee72c32615f22eea", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "fc8e4a79cf0d59239b0c38a00077be9c", "key": "extraReferences"}, {"hash": "a89f01bde8c28c5ef880a8e031c8abc9", "key": "cvss3"}, {"hash": "f2747c81ae180ef120431e6b557fe202", "key": "cvelist"}, {"hash": "c0109a7a7623f17fc90435167ea606f4", "key": "cpe23"}, {"hash": "16b533ac1ca3f853b12fda5415a759ca", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "faab7597486b38363731adfe8b01a307", "key": "description"}, {"hash": "aae19cc71ef4568916460e41c6f1d931", "key": "cpe"}, {"hash": "07328335863c93f7825c07c2d14e1d32", "key": "affectedSoftware"}, {"hash": "028861521b75526ad56de80438fe419b", "key": "cpeConfiguration"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "876f47c4ebc2b9e0dd17afaa22819f2a", "key": "cvss"}, {"hash": "7c890ef3388c97062835b70e4d7f0cd7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "id": "CVE-2020-16950", "immutableFields": [], "lastseen": "2021-02-02T07:37:01", "modified": "2020-10-20T14:26:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "reporter": "cve@mitre.org", "title": "CVE-2020-16950", "type": "cve", "viewCount": 12}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 4, "lastseen": "2021-02-02T07:37:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_server:2019"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-21T11:10:18", "references": [{"idList": ["MS:CVE-2020-16950"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KB4486676"], "type": "mskb"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-21T11:10:18", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [], "hash": "2d0b3aaf5bd1af126d0ae307debb6997e4e6157acb8ab6275a0d6b6981b6bfb3", "hashmap": [{"hash": "434669adc8d0504de64471dd6747c2c7", "key": "cvss2"}, {"hash": "27b2a2b39d9a237a62c08924e3bc5cde", "key": "modified"}, {"hash": "1e5c655863833a3cee72c32615f22eea", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "a89f01bde8c28c5ef880a8e031c8abc9", "key": "cvss3"}, {"hash": "f2747c81ae180ef120431e6b557fe202", "key": "cvelist"}, {"hash": "c0109a7a7623f17fc90435167ea606f4", "key": "cpe23"}, {"hash": "16b533ac1ca3f853b12fda5415a759ca", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "faab7597486b38363731adfe8b01a307", "key": "description"}, {"hash": "aae19cc71ef4568916460e41c6f1d931", "key": "cpe"}, {"hash": "07328335863c93f7825c07c2d14e1d32", "key": "affectedSoftware"}, {"hash": "028861521b75526ad56de80438fe419b", "key": "cpeConfiguration"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "876f47c4ebc2b9e0dd17afaa22819f2a", "key": "cvss"}, {"hash": "7c890ef3388c97062835b70e4d7f0cd7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "id": "CVE-2020-16950", "lastseen": "2020-10-21T11:10:18", "modified": "2020-10-20T14:26:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "reporter": "cve@mitre.org", "title": "CVE-2020-16950", "type": "cve", "viewCount": 11}, "differentElements": ["extraReferences"], "edition": 3, "lastseen": "2020-10-21T11:10:18"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16950"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-10-20T11:10:53", "references": [{"idList": ["MS:CVE-2020-16950"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-20T11:10:53", "rev": 2, "value": 1.9, "vector": "NONE"}}, "hash": "614d17c4308d2cdb382645f5100e9cd296592752d949ec2f1b278afb6f84a025", "hashmap": [{"hash": "1e5c655863833a3cee72c32615f22eea", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "f2747c81ae180ef120431e6b557fe202", "key": "cvelist"}, {"hash": "16b533ac1ca3f853b12fda5415a759ca", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "faab7597486b38363731adfe8b01a307", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "c2446defffc859bf0498b825967541c5", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "7c890ef3388c97062835b70e4d7f0cd7", "key": "title"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "id": "CVE-2020-16950", "lastseen": "2020-10-20T11:10:53", "modified": "2020-10-19T11:42:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "reporter": "cve@mitre.org", "title": "CVE-2020-16950", "type": "cve", "viewCount": 0}, "differentElements": ["cpe23", "cvss", "cvss3", "cvss2", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 2, "lastseen": "2020-10-20T11:10:53"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16950"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16953.", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-10-17T11:07:32", "references": [{"idList": ["MS:CVE-2020-16950"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-17T11:07:32", "rev": 2, "value": 1.9, "vector": "NONE"}}, "hash": "19895a5938745fc90802ca44b4bb4faa7ee550365d5a58546c2b150fd6456642", "hashmap": [{"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "modified"}, {"hash": "1e5c655863833a3cee72c32615f22eea", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "f2747c81ae180ef120431e6b557fe202", "key": "cvelist"}, {"hash": "16b533ac1ca3f853b12fda5415a759ca", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "faab7597486b38363731adfe8b01a307", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "7c890ef3388c97062835b70e4d7f0cd7", "key": "title"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16950", "id": "CVE-2020-16950", "lastseen": "2020-10-17T11:07:32", "modified": "2020-10-16T23:15:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"], "reporter": "cve@mitre.org", "title": "CVE-2020-16950", "type": "cve", "viewCount": 0}, "differentElements": ["modified"], "edition": 1, "lastseen": "2020-10-17T11:07:32"}], "edition": 7, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "07328335863c93f7825c07c2d14e1d32"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "aae19cc71ef4568916460e41c6f1d931"}, {"key": "cpe23", "hash": "c0109a7a7623f17fc90435167ea606f4"}, {"key": "cpeConfiguration", "hash": "cb88f326ecdc38e546d7620cb71542d8"}, {"key": "cvelist", "hash": "f2747c81ae180ef120431e6b557fe202"}, {"key": "cvss", "hash": "876f47c4ebc2b9e0dd17afaa22819f2a"}, {"key": "cvss2", "hash": "434669adc8d0504de64471dd6747c2c7"}, {"key": "cvss3", "hash": "a89f01bde8c28c5ef880a8e031c8abc9"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "faab7597486b38363731adfe8b01a307"}, {"key": "extraReferences", "hash": "fc8e4a79cf0d59239b0c38a00077be9c"}, {"key": "href", "hash": "1e5c655863833a3cee72c32615f22eea"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "183798fce373747341ba2f32f8021ac7"}, {"key": "published", "hash": "ccdbc538dd5b4d39f6035c206ec1fa15"}, {"key": "references", "hash": "16b533ac1ca3f853b12fda5415a759ca"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "7c890ef3388c97062835b70e4d7f0cd7"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "abb8ffb043550b9bd6f12cfcef64273125c63241c987943c764c6129373cbf9f", "viewCount": 39, "enchantments": {"dependencies": {"references": [{"type": "mscve", "idList": ["MS:CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-08-04T16:55:08", "rev": 2}, "score": {"value": 1.9, "vector": "NONE", "modified": "2021-08-04T16:55:08", "rev": 2}}, "objectVersion": "1.6", "cpe": ["cpe:/a:microsoft:sharepoint_server:2019"], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950"}], "immutableFields": []}, {"id": "CVE-2020-16948", "bulletinFamily": "NVD", "title": "CVE-2020-16948", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16950, CVE-2020-16953.", "published": "2020-10-16T23:15:00", "modified": "2020-10-20T19:17:00", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16948", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"], "cvelist": ["CVE-2020-16948"], "type": "cve", "lastseen": "2021-04-23T01:09:38", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16948"], "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16950, CVE-2020-16953.", "edition": 3, "enchantments": {"dependencies": {"modified": "2021-02-02T07:37:01", "references": [{"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["MS:CVE-2020-16948"], "type": "mscve"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-02-02T07:37:01", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"}], "hash": "3819b8498317aec75ebf548f8f3f379ead6c6bbe68e85ac5aa88bef6f2ea5304", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "be740bd03addbd3111967e35c380de5f", "key": "extraReferences"}, {"hash": "6233c79d06a8c125d1e86f6ba49e37ca", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "07a69fb94693e6a2da876529ddd1e0ec", "key": "cvss2"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "62fc0ac16edd10375239eb52fdb20481", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8a3fc2f25667534c5c7b48db8736d874", "key": "title"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "e8d0af68bb102357c1a66383d1243ed9", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "e258b79b31d39a327c9dafeb61b7a729", "key": "cvss"}, {"hash": "edad96ef8541e7706930861fb3e0ad7c", "key": "modified"}, {"hash": "e2529ce72f1327ac95df974bbd5fb25f", "key": "description"}, {"hash": "895b66504fc9402b1b6c4c70b85c81b0", "key": "cvelist"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16948", "id": "CVE-2020-16948", "immutableFields": [], "lastseen": "2021-02-02T07:37:01", "modified": "2020-10-20T19:17:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"], "reporter": "cve@mitre.org", "title": "CVE-2020-16948", "type": "cve", "viewCount": 37}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 3, "lastseen": "2021-02-02T07:37:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16948"], "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16950, CVE-2020-16953.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-10-21T11:10:18", "references": [{"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["MS:CVE-2020-16948"], "type": "mscve"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2020-10-21T11:10:18", "rev": 2, "value": 1.9, "vector": "NONE"}}, "extraReferences": [], "hash": "d23fcdd99c472706e35c0797260c4166cc793c078915815492dee1e95332658f", "hashmap": [{"hash": "6233c79d06a8c125d1e86f6ba49e37ca", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "07a69fb94693e6a2da876529ddd1e0ec", "key": "cvss2"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "62fc0ac16edd10375239eb52fdb20481", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8a3fc2f25667534c5c7b48db8736d874", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "e8d0af68bb102357c1a66383d1243ed9", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "e258b79b31d39a327c9dafeb61b7a729", "key": "cvss"}, {"hash": "edad96ef8541e7706930861fb3e0ad7c", "key": "modified"}, {"hash": "e2529ce72f1327ac95df974bbd5fb25f", "key": "description"}, {"hash": "895b66504fc9402b1b6c4c70b85c81b0", "key": "cvelist"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16948", "id": "CVE-2020-16948", "lastseen": "2020-10-21T11:10:18", "modified": "2020-10-20T19:17:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"], "reporter": "cve@mitre.org", "title": "CVE-2020-16948", "type": "cve", "viewCount": 35}, "differentElements": ["extraReferences"], "edition": 2, "lastseen": "2020-10-21T11:10:18"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16948"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16950, CVE-2020-16953.", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-10-17T11:07:32", "references": [{"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["MS:CVE-2020-16948"], "type": "mscve"}], "rev": 2}, "score": {"modified": "2020-10-17T11:07:32", "rev": 2, "value": 1.6, "vector": "NONE"}}, "hash": "dbdb25498bea77cd8f729ef9acefda80f94cd32969b0755fa38eed12dd17af51", "hashmap": [{"hash": "6233c79d06a8c125d1e86f6ba49e37ca", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "a8675f673834d90d3f00772136546fb0", "key": "modified"}, {"hash": "62fc0ac16edd10375239eb52fdb20481", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "8a3fc2f25667534c5c7b48db8736d874", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "e2529ce72f1327ac95df974bbd5fb25f", "key": "description"}, {"hash": "895b66504fc9402b1b6c4c70b85c81b0", "key": "cvelist"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16948", "id": "CVE-2020-16948", "lastseen": "2020-10-17T11:07:32", "modified": "2020-10-17T00:23:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"], "reporter": "cve@mitre.org", "title": "CVE-2020-16948", "type": "cve", "viewCount": 22}, "differentElements": ["cpe23", "cvss", "cvss3", "cvss2", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 1, "lastseen": "2020-10-17T11:07:32"}], "edition": 4, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "3d40d6572111992afca3d166255d1065"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "cad61c7f570b81e1ee336b4b66b54e65"}, {"key": "cpe23", "hash": "378a811bcf371ec8e1fc89a6b7f48ea3"}, {"key": "cpeConfiguration", "hash": "6b63f6a14ace2542f41df76681f6184b"}, {"key": "cvelist", "hash": "895b66504fc9402b1b6c4c70b85c81b0"}, {"key": "cvss", "hash": "e258b79b31d39a327c9dafeb61b7a729"}, {"key": "cvss2", "hash": "07a69fb94693e6a2da876529ddd1e0ec"}, {"key": "cvss3", "hash": "e8d0af68bb102357c1a66383d1243ed9"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "e2529ce72f1327ac95df974bbd5fb25f"}, {"key": "extraReferences", "hash": "be740bd03addbd3111967e35c380de5f"}, {"key": "href", "hash": "6233c79d06a8c125d1e86f6ba49e37ca"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "edad96ef8541e7706930861fb3e0ad7c"}, {"key": "published", "hash": "ccdbc538dd5b4d39f6035c206ec1fa15"}, {"key": "references", "hash": "62fc0ac16edd10375239eb52fdb20481"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "8a3fc2f25667534c5c7b48db8736d874"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "d9c6e631d20cf68589238f552c9f5124539a00692691a36c8b37f36797e11dba", "viewCount": 64, "enchantments": {"dependencies": {"references": [{"type": "mscve", "idList": ["MS:CVE-2020-16948"]}, {"type": "mskb", "idList": ["KB4486676", "KB4486708", "KB4486677", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-04-23T01:09:38", "rev": 2}, "score": {"value": 1.9, "vector": "NONE", "modified": "2021-04-23T01:09:38", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16948"}], "immutableFields": []}, {"id": "CVE-2020-16942", "bulletinFamily": "NVD", "title": "CVE-2020-16942", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "published": "2020-10-16T23:15:00", "modified": "2021-07-21T11:39:00", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "cvelist": ["CVE-2020-16942"], "type": "cve", "lastseen": "2021-08-04T16:55:08", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16942"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-10-21T11:10:18", "references": [{"idList": ["MS:CVE-2020-16942"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2020-10-21T11:10:18", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [], "hash": "8cc5a48860b5310b2a72814ffdb4f757afdb30b26ff51697b0e78bd1f22c4cf7", "hashmap": [{"hash": "760d537b32a4bf798c6adcb9dbc9af56", "key": "cvelist"}, {"hash": "567e6fcd829e7def1b7d9133dfb7fc6d", "key": "description"}, {"hash": "ef8370fd00c50b6a856b1d733148cf2f", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d6ffad3a100178d04d1d80cd49734799", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "816098ed626cd352d6f7242d55c1c748", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1ad11d4135ee7955b24880820e05608d", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "8045fda336e6c98c9ad4ee81abd0fbe7", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "id": "CVE-2020-16942", "lastseen": "2020-10-21T11:10:18", "modified": "2020-10-20T19:34:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "reporter": "cve@mitre.org", "title": "CVE-2020-16942", "type": "cve", "viewCount": 13}, "differentElements": ["extraReferences"], "edition": 2, "lastseen": "2020-10-21T11:10:18"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16942"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 3, "enchantments": {"dependencies": {"modified": "2021-02-02T07:37:01", "references": [{"idList": ["MS:CVE-2020-16942"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-02-02T07:37:01", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"}], "hash": "ba481f3913015bf0a5281a85b1be2d92494deb448037ae5a599674873760ad44", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "760d537b32a4bf798c6adcb9dbc9af56", "key": "cvelist"}, {"hash": "567e6fcd829e7def1b7d9133dfb7fc6d", "key": "description"}, {"hash": "ef8370fd00c50b6a856b1d733148cf2f", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d6ffad3a100178d04d1d80cd49734799", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "816098ed626cd352d6f7242d55c1c748", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1ad11d4135ee7955b24880820e05608d", "key": "cvss3"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "50b0f1ecf3968c7184893014eb9704fd", "key": "extraReferences"}, {"hash": "8045fda336e6c98c9ad4ee81abd0fbe7", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "id": "CVE-2020-16942", "immutableFields": [], "lastseen": "2021-02-02T07:37:01", "modified": "2020-10-20T19:34:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "reporter": "cve@mitre.org", "title": "CVE-2020-16942", "type": "cve", "viewCount": 14}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 3, "lastseen": "2021-02-02T07:37:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16942"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-04-23T01:09:38", "references": [{"idList": ["MS:CVE-2020-16942"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-04-23T01:09:38", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"}], "hash": "a0a888f9093738020932ebbc6be1ca344d69fb071c68cd4341c10d8f104ff6d6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "760d537b32a4bf798c6adcb9dbc9af56", "key": "cvelist"}, {"hash": "567e6fcd829e7def1b7d9133dfb7fc6d", "key": "description"}, {"hash": "ef8370fd00c50b6a856b1d733148cf2f", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d6ffad3a100178d04d1d80cd49734799", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "6b63f6a14ace2542f41df76681f6184b", "key": "cpeConfiguration"}, {"hash": "816098ed626cd352d6f7242d55c1c748", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1ad11d4135ee7955b24880820e05608d", "key": "cvss3"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "50b0f1ecf3968c7184893014eb9704fd", "key": "extraReferences"}, {"hash": "8045fda336e6c98c9ad4ee81abd0fbe7", "key": "href"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "id": "CVE-2020-16942", "immutableFields": [], "lastseen": "2021-04-23T01:09:38", "modified": "2020-10-20T19:34:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16942", "type": "cve", "viewCount": 17}, "different_elements": ["modified"], "edition": 4, "lastseen": "2021-04-23T01:09:38"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16942"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 5, "enchantments": {"dependencies": {"modified": "2021-07-22T08:54:28", "references": [{"idList": ["MS:CVE-2020-16942"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-07-22T08:54:28", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"}], "hash": "e45d2de57d29616e5e25afcf6ae0940ff8f7f4b3e66b0dd6191f2f61212480cf", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "760d537b32a4bf798c6adcb9dbc9af56", "key": "cvelist"}, {"hash": "567e6fcd829e7def1b7d9133dfb7fc6d", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d6ffad3a100178d04d1d80cd49734799", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "6b63f6a14ace2542f41df76681f6184b", "key": "cpeConfiguration"}, {"hash": "816098ed626cd352d6f7242d55c1c748", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1ad11d4135ee7955b24880820e05608d", "key": "cvss3"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "50b0f1ecf3968c7184893014eb9704fd", "key": "extraReferences"}, {"hash": "8045fda336e6c98c9ad4ee81abd0fbe7", "key": "href"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "183798fce373747341ba2f32f8021ac7", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "id": "CVE-2020-16942", "immutableFields": [], "lastseen": "2021-07-22T08:54:28", "modified": "2021-07-21T11:39:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16942", "type": "cve", "viewCount": 17}, "different_elements": ["cwe"], "edition": 5, "lastseen": "2021-07-22T08:54:28"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16942"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-10-17T11:07:32", "references": [{"idList": ["MS:CVE-2020-16942"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}], "rev": 2}, "score": {"modified": "2020-10-17T11:07:32", "rev": 2, "value": 1.9, "vector": "NONE"}}, "hash": "134460b57b810048e8a84b68f52e26d5c2e35548de0f51fdae1b000c26a470ba", "hashmap": [{"hash": "760d537b32a4bf798c6adcb9dbc9af56", "key": "cvelist"}, {"hash": "567e6fcd829e7def1b7d9133dfb7fc6d", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d6ffad3a100178d04d1d80cd49734799", "key": "references"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "816098ed626cd352d6f7242d55c1c748", "key": "title"}, {"hash": "a8675f673834d90d3f00772136546fb0", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "8045fda336e6c98c9ad4ee81abd0fbe7", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16942", "id": "CVE-2020-16942", "lastseen": "2020-10-17T11:07:32", "modified": "2020-10-17T00:23:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"], "reporter": "cve@mitre.org", "title": "CVE-2020-16942", "type": "cve", "viewCount": 0}, "differentElements": ["cpe23", "cvss", "cvss3", "cvss2", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 1, "lastseen": "2020-10-17T11:07:32"}], "edition": 6, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "3d40d6572111992afca3d166255d1065"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "cad61c7f570b81e1ee336b4b66b54e65"}, {"key": "cpe23", "hash": "378a811bcf371ec8e1fc89a6b7f48ea3"}, {"key": "cpeConfiguration", "hash": "6b63f6a14ace2542f41df76681f6184b"}, {"key": "cvelist", "hash": "760d537b32a4bf798c6adcb9dbc9af56"}, {"key": "cvss", "hash": "8c29e327ecae9940af88849fdeee038f"}, {"key": "cvss2", "hash": "9f7eb056be41da456478766e5dd03221"}, {"key": "cvss3", "hash": "1ad11d4135ee7955b24880820e05608d"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "567e6fcd829e7def1b7d9133dfb7fc6d"}, {"key": "extraReferences", "hash": "50b0f1ecf3968c7184893014eb9704fd"}, {"key": "href", "hash": "8045fda336e6c98c9ad4ee81abd0fbe7"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "183798fce373747341ba2f32f8021ac7"}, {"key": "published", "hash": "ccdbc538dd5b4d39f6035c206ec1fa15"}, {"key": "references", "hash": "d6ffad3a100178d04d1d80cd49734799"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "816098ed626cd352d6f7242d55c1c748"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "9aafdac7c185962a132d393fd3db67d6b29f10b32c02657e238a3aff58af3dc5", "viewCount": 41, "enchantments": {"dependencies": {"references": [{"type": "mscve", "idList": ["MS:CVE-2020-16942"]}, {"type": "mskb", "idList": ["KB4486676", "KB4486708", "KB4486677", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-08-04T16:55:08", "rev": 2}, "score": {"value": 2.2, "vector": "NONE", "modified": "2021-08-04T16:55:08", "rev": 2}}, "objectVersion": "1.6", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16942"}], "immutableFields": []}, {"id": "CVE-2020-16941", "bulletinFamily": "NVD", "title": "CVE-2020-16941", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "published": "2020-10-16T23:15:00", "modified": "2021-07-21T11:39:00", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "reporter": "secure@microsoft.com", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "cvelist": ["CVE-2020-16941"], "type": "cve", "lastseen": "2021-08-04T16:55:08", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16941"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-10-21T11:10:18", "references": [{"idList": ["MS:CVE-2020-16941"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2020-10-21T11:10:18", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [], "hash": "2cd74fe068fde14e27f66812561e1b1134f84cc3a3259bb46abd26b19846b1c8", "hashmap": [{"hash": "1f09d60faf9fb2ee693f3cc59db61677", "key": "title"}, {"hash": "a3e63a1dc11794bca858a01766b4cca8", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "b6f03ca2065933c53334e7b18dbeabd3", "key": "description"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "37d5277fc04c236e9b727eef5f4c1435", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8a2749d005c04012f55dc5e877f90375", "key": "references"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "29da3369189a06cee6ff38f1beb227e9", "key": "cvss3"}, {"hash": "f4fe92c3237a6c63a172bbf1134b3fb8", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "id": "CVE-2020-16941", "lastseen": "2020-10-21T11:10:18", "modified": "2020-10-20T19:15:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "reporter": "cve@mitre.org", "title": "CVE-2020-16941", "type": "cve", "viewCount": 12}, "differentElements": ["extraReferences"], "edition": 2, "lastseen": "2020-10-21T11:10:18"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16941"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 3, "enchantments": {"dependencies": {"modified": "2021-02-02T07:37:01", "references": [{"idList": ["MS:CVE-2020-16941"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-02-02T07:37:01", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"}], "hash": "4cb40a6e8b9f10974dcf9953d868c4c826e670e4da5ac111c00cf79470ac068a", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "1f09d60faf9fb2ee693f3cc59db61677", "key": "title"}, {"hash": "a3e63a1dc11794bca858a01766b4cca8", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "b6f03ca2065933c53334e7b18dbeabd3", "key": "description"}, {"hash": "480a97d3ccd796659e41d328654945d0", "key": "cpeConfiguration"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "37d5277fc04c236e9b727eef5f4c1435", "key": "cvelist"}, {"hash": "12fc037746069c3028f9eb641d022932", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8a2749d005c04012f55dc5e877f90375", "key": "references"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "29da3369189a06cee6ff38f1beb227e9", "key": "cvss3"}, {"hash": "f4fe92c3237a6c63a172bbf1134b3fb8", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "id": "CVE-2020-16941", "immutableFields": [], "lastseen": "2021-02-02T07:37:01", "modified": "2020-10-20T19:15:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "reporter": "cve@mitre.org", "title": "CVE-2020-16941", "type": "cve", "viewCount": 13}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 3, "lastseen": "2021-02-02T07:37:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16941"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 5, "enchantments": {"dependencies": {"modified": "2021-07-22T08:54:28", "references": [{"idList": ["MS:CVE-2020-16941"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-07-22T08:54:28", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"}], "hash": "63f11dfca65c34ea12b208066d641199924a12b97de8c8cd62ba92bbf36a7299", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "1f09d60faf9fb2ee693f3cc59db61677", "key": "title"}, {"hash": "a3e63a1dc11794bca858a01766b4cca8", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "b6f03ca2065933c53334e7b18dbeabd3", "key": "description"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "6b63f6a14ace2542f41df76681f6184b", "key": "cpeConfiguration"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "37d5277fc04c236e9b727eef5f4c1435", "key": "cvelist"}, {"hash": "12fc037746069c3028f9eb641d022932", "key": "extraReferences"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8a2749d005c04012f55dc5e877f90375", "key": "references"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "29da3369189a06cee6ff38f1beb227e9", "key": "cvss3"}, {"hash": "183798fce373747341ba2f32f8021ac7", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "id": "CVE-2020-16941", "immutableFields": [], "lastseen": "2021-07-22T08:54:28", "modified": "2021-07-21T11:39:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16941", "type": "cve", "viewCount": 16}, "different_elements": ["cwe"], "edition": 5, "lastseen": "2021-07-22T08:54:28"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2020-16941"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-10-17T11:07:32", "references": [{"idList": ["MS:CVE-2020-16941"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-17T11:07:32", "rev": 2, "value": 2.2, "vector": "NONE"}}, "hash": "4d455ad89ef19250d0a93b895d7b69f400919aa5c39a4d84273e0cbb68d89906", "hashmap": [{"hash": "1f09d60faf9fb2ee693f3cc59db61677", "key": "title"}, {"hash": "a3e63a1dc11794bca858a01766b4cca8", "key": "href"}, {"hash": "e1830bc9646a937aba1cb2a528f5f03d", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "b6f03ca2065933c53334e7b18dbeabd3", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "37d5277fc04c236e9b727eef5f4c1435", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8a2749d005c04012f55dc5e877f90375", "key": "references"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "id": "CVE-2020-16941", "lastseen": "2020-10-17T11:07:32", "modified": "2020-10-17T00:24:00", "objectVersion": "1.3", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "reporter": "cve@mitre.org", "title": "CVE-2020-16941", "type": "cve", "viewCount": 0}, "differentElements": ["cpe23", "cvss", "cvss3", "cvss2", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 1, "lastseen": "2020-10-17T11:07:32"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2020-16941"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cwe": ["CWE-200"], "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-04-23T01:09:38", "references": [{"idList": ["MS:CVE-2020-16941"], "type": "mscve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}, {"idList": ["KB4486677", "KB4486694", "KB4486676", "KB4486708"], "type": "mskb"}], "rev": 2}, "score": {"modified": "2021-04-23T01:09:38", "rev": 2, "value": 2.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"}], "hash": "5d8f2d00adbbac8bd3c63b6e60657c2985f76078be4b17408e60d8dc13ec01c7", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "1f09d60faf9fb2ee693f3cc59db61677", "key": "title"}, {"hash": "a3e63a1dc11794bca858a01766b4cca8", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "ccdbc538dd5b4d39f6035c206ec1fa15", "key": "published"}, {"hash": "b6f03ca2065933c53334e7b18dbeabd3", "key": "description"}, {"hash": "9f7eb056be41da456478766e5dd03221", "key": "cvss2"}, {"hash": "cad61c7f570b81e1ee336b4b66b54e65", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "6b63f6a14ace2542f41df76681f6184b", "key": "cpeConfiguration"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "37d5277fc04c236e9b727eef5f4c1435", "key": "cvelist"}, {"hash": "12fc037746069c3028f9eb641d022932", "key": "extraReferences"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8a2749d005c04012f55dc5e877f90375", "key": "references"}, {"hash": "378a811bcf371ec8e1fc89a6b7f48ea3", "key": "cpe23"}, {"hash": "3d40d6572111992afca3d166255d1065", "key": "affectedSoftware"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "29da3369189a06cee6ff38f1beb227e9", "key": "cvss3"}, {"hash": "f4fe92c3237a6c63a172bbf1134b3fb8", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16941", "id": "CVE-2020-16941", "immutableFields": [], "lastseen": "2021-04-23T01:09:38", "modified": "2020-10-20T19:15:00", "objectVersion": "1.5", "published": "2020-10-16T23:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"], "reporter": "secure@microsoft.com", "title": "CVE-2020-16941", "type": "cve", "viewCount": 16}, "different_elements": ["modified"], "edition": 4, "lastseen": "2021-04-23T01:09:38"}], "edition": 6, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "3d40d6572111992afca3d166255d1065"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "cad61c7f570b81e1ee336b4b66b54e65"}, {"key": "cpe23", "hash": "378a811bcf371ec8e1fc89a6b7f48ea3"}, {"key": "cpeConfiguration", "hash": "6b63f6a14ace2542f41df76681f6184b"}, {"key": "cvelist", "hash": "37d5277fc04c236e9b727eef5f4c1435"}, {"key": "cvss", "hash": "8c29e327ecae9940af88849fdeee038f"}, {"key": "cvss2", "hash": "9f7eb056be41da456478766e5dd03221"}, {"key": "cvss3", "hash": "29da3369189a06cee6ff38f1beb227e9"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "b6f03ca2065933c53334e7b18dbeabd3"}, {"key": "extraReferences", "hash": "12fc037746069c3028f9eb641d022932"}, {"key": "href", "hash": "a3e63a1dc11794bca858a01766b4cca8"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "183798fce373747341ba2f32f8021ac7"}, {"key": "published", "hash": "ccdbc538dd5b4d39f6035c206ec1fa15"}, {"key": "references", "hash": "8a2749d005c04012f55dc5e877f90375"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "1f09d60faf9fb2ee693f3cc59db61677"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a024a72137b3ea5ec028a452ace1dab5b0481513e68a5c8249a77d93b1e32760", "viewCount": 40, "enchantments": {"dependencies": {"references": [{"type": "mscve", "idList": ["MS:CVE-2020-16941"]}, {"type": "mskb", "idList": ["KB4486676", "KB4486708", "KB4486677", "KB4486694"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2016.NASL", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2013.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2010.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-08-04T16:55:08", "rev": 2}, "score": {"value": 2.2, "vector": "NONE", "modified": "2021-08-04T16:55:08", "rev": 2}}, "objectVersion": "1.6", "cpe": ["cpe:/a:microsoft:sharepoint_foundation:2013", "cpe:/a:microsoft:sharepoint_server:2019", "cpe:/a:microsoft:sharepoint_foundation:2010", "cpe:/a:microsoft:sharepoint_enterprise_server:2016"], "affectedSoftware": [{"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2013"}, {"cpeName": "microsoft:sharepoint_enterprise_server", "name": "microsoft sharepoint enterprise server", "operator": "eq", "version": "2016"}, {"cpeName": "microsoft:sharepoint_foundation", "name": "microsoft sharepoint foundation", "operator": "eq", "version": "2010"}, {"cpeName": "microsoft:sharepoint_server", "name": "microsoft sharepoint server", "operator": "eq", "version": "2019"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*", "cpe:2.3:a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16941"}], "immutableFields": []}, {"bulletinFamily": "NVD", "hash": "6a0ace8cdb63863b470e6561269f441d83851201520bc6a55e7930a925c15e3a", "id": "CVE-2014-2595", "lastseen": "2021-04-22T23:44:08", "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "objectVersion": "1.5", "published": "2020-02-12T01:15:00", "cvelist": ["CVE-2014-2595"], "viewCount": 73, "modified": "2020-02-20T15:55:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "edition": 8, "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "history": [{"bulletin": {"affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cvelist": ["CVE-2014-2595"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-02-13T14:29:47", "references": [{"idList": ["PACKETSTORM:127740"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:31004", "SECURITYVULNS:VULN:13887"], "type": "securityvulns"}, {"idList": ["EDB-ID:39278"], "type": "exploitdb"}]}, "score": {"modified": "2020-02-13T14:29:47", "value": 6.9, "vector": "NONE"}}, "hash": "0d148bb322c927927cf5c8adaba4daf0d811bf2bee4917f93ca62ca2f942333e", "hashmap": [{"hash": "584cd9e6927eaaa814c6545414f09911", "key": "description"}, {"hash": "cf46dbeffc0c7dc51130bcd388b4459a", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "afd8c4a8002c25596504fc1efc107886", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "23075837e6c728c8f0077b2ae5d5ee7f", "key": "modified"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "published"}, {"hash": "756bd44ad36e62b951b7a08611cbd3f5", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "bc7f8fc71017e1124d57947313af5643", "key": "title"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "id": "CVE-2014-2595", "lastseen": "2020-02-13T14:29:47", "modified": "2020-02-12T13:07:00", "objectVersion": "1.3", "published": "2020-02-12T01:15:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "type": "cve", "viewCount": 28}, "differentElements": ["cpe23", "cvss", "cvss2", "modified", "cpe", "cwe", "affectedSoftware"], "edition": 3, "lastseen": "2020-02-13T14:29:47"}, {"bulletin": {"affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cvelist": ["CVE-2014-2595"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-02-12T14:27:29", "references": [{"idList": ["PACKETSTORM:127740"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:31004", "SECURITYVULNS:VULN:13887"], "type": "securityvulns"}, {"idList": ["EDB-ID:39278"], "type": "exploitdb"}]}, "score": {"modified": "2020-02-12T14:27:29", "value": 6.9, "vector": "NONE"}}, "hash": "6ccf8f84237981876cda9914b348e4e11c8972875cdf630f59422732f1ea69ba", "hashmap": [{"hash": "584cd9e6927eaaa814c6545414f09911", "key": "description"}, {"hash": "cf46dbeffc0c7dc51130bcd388b4459a", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "modified"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "afd8c4a8002c25596504fc1efc107886", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "published"}, {"hash": "756bd44ad36e62b951b7a08611cbd3f5", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "bc7f8fc71017e1124d57947313af5643", "key": "title"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "id": "CVE-2014-2595", "lastseen": "2020-02-12T14:27:29", "modified": "2020-02-12T01:15:00", "objectVersion": "1.3", "published": "2020-02-12T01:15:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "type": "cve", "viewCount": 28}, "differentElements": ["modified"], "edition": 2, "lastseen": "2020-02-12T14:27:29"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "barracuda:web_application_firewall", "name": "barracuda web application firewall", "operator": "eq", "version": "7.8.1.013"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:barracuda:web_application_firewall:7.8.1.013"], "cpe23": ["cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2014-2595"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "cwe": ["CWE-613"], "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "edition": 6, "enchantments": {"dependencies": {"modified": "2020-10-03T12:01:15", "references": [{"idList": ["PACKETSTORM:127740"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:31004", "SECURITYVULNS:VULN:13887"], "type": "securityvulns"}, {"idList": ["EDB-ID:39278"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2020-10-03T12:01:15", "rev": 2, "value": 6.9, "vector": "NONE"}}, "extraReferences": [], "hash": "65fabd8c3b92ccbba797b3dfba517234b9e0e8bc2464531f2cd64047dd457870", "hashmap": [{"hash": "584cd9e6927eaaa814c6545414f09911", "key": "description"}, {"hash": "cf46dbeffc0c7dc51130bcd388b4459a", "key": "references"}, {"hash": "92ee34fefd5301ff6ccb77b813c8d4f8", "key": "modified"}, {"hash": "86870277fcb3e3e121fe9e4f1f7c2b51", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "405ecfc0fb244283a2773863614145bf", "key": "cpe23"}, {"hash": "e63509ce8b627fb239a5a63969122026", "key": "cvss2"}, {"hash": "832b9c21b4589969549f63eb0724398c", "key": "cpe"}, {"hash": "0e66a595df2112e69adac8e55cbdb92d", "key": "cpeConfiguration"}, {"hash": "a97b191a26cb922c0b82d26c5f04f4db", "key": "affectedSoftware"}, {"hash": "ad35358d166de03a84a3a9280d95337a", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "afd8c4a8002c25596504fc1efc107886", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "published"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "756bd44ad36e62b951b7a08611cbd3f5", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "bc7f8fc71017e1124d57947313af5643", "key": "title"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "id": "CVE-2014-2595", "lastseen": "2020-10-03T12:01:15", "modified": "2020-02-20T15:55:00", "objectVersion": "1.3", "published": "2020-02-12T01:15:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "type": "cve", "viewCount": 56}, "differentElements": ["extraReferences"], "edition": 6, "lastseen": "2020-10-03T12:01:15"}, {"bulletin": {"affectedSoftware": [{"name": "barracuda web_application_firewall", "operator": "eq", "version": "7.8.1.013"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:barracuda:web_application_firewall:7.8.1.013"], "cpe23": ["cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*"], "cvelist": ["CVE-2014-2595"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-613"], "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-02-21T13:06:26", "references": [{"idList": ["PACKETSTORM:127740"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:31004", "SECURITYVULNS:VULN:13887"], "type": "securityvulns"}, {"idList": ["EDB-ID:39278"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2020-02-21T13:06:26", "rev": 2, "value": 6.9, "vector": "NONE"}}, "hash": "4423bdd8d6936961112ee89e752cf7c866f443470052f4a4ac3529b4be6ae18f", "hashmap": [{"hash": "584cd9e6927eaaa814c6545414f09911", "key": "description"}, {"hash": "cf46dbeffc0c7dc51130bcd388b4459a", "key": "references"}, {"hash": "92ee34fefd5301ff6ccb77b813c8d4f8", "key": "modified"}, {"hash": "86870277fcb3e3e121fe9e4f1f7c2b51", "key": "cwe"}, {"hash": "405ecfc0fb244283a2773863614145bf", "key": "cpe23"}, {"hash": "e63509ce8b627fb239a5a63969122026", "key": "cvss2"}, {"hash": "832b9c21b4589969549f63eb0724398c", "key": "cpe"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "afd8c4a8002c25596504fc1efc107886", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "published"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "756bd44ad36e62b951b7a08611cbd3f5", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "bc7f8fc71017e1124d57947313af5643", "key": "title"}, {"hash": "ee2d931efb4c4fa7a1a321df76c0b838", "key": "affectedSoftware"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "id": "CVE-2014-2595", "lastseen": "2020-02-21T13:06:26", "modified": "2020-02-20T15:55:00", "objectVersion": "1.3", "published": "2020-02-12T01:15:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "type": "cve", "viewCount": 47}, "differentElements": ["cvss3", "affectedSoftware"], "edition": 4, "lastseen": "2020-02-21T13:06:26"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "barracuda:web_application_firewall", "name": "barracuda web application firewall", "operator": "eq", "version": "7.8.1.013"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:barracuda:web_application_firewall:7.8.1.013"], "cpe23": ["cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2014-2595"], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "cwe": ["CWE-613"], "description": "Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.", "edition": 7, "enchantments": {"dependencies": {"modified": "2021-02-02T06:14:28", "references": [{"idList": ["PACKETSTORM:127740"], "type": "packetstorm"}, {"idList": ["SECURITYVULNS:DOC:31004", "SECURITYVULNS:VULN:13887"], "type": "securityvulns"}, {"idList": ["EDB-ID:39278"], "type": "exploitdb"}], "rev": 2}, "score": {"modified": "2021-02-02T06:14:28", "rev": 2, "value": 6.9, "vector": "NONE"}}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004"}, {"name": "http://www.osvdb.org/109782", "refsource": "MISC", "tags": ["Broken Link"], "url": "http://www.osvdb.org/109782"}, {"name": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "refsource": "MISC", "tags": ["Broken Link"], "url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/"}, {"name": "https://www.exploit-db.com/exploits/39278", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/39278"}, {"name": "https://www.securityfocus.com/bid/69028", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "https://www.securityfocus.com/bid/69028"}, {"name": "http://seclists.org/fulldisclosure/2014/Aug/5", "refsource": "MISC", "tags": ["Third Party Advisory", "Mailing List", "Exploit"], "url": "http://seclists.org/fulldisclosure/2014/Aug/5"}], "hash": "d6e72c33ebf3accfe25046812d0b1e7698f2d37c9159defa7c7bda26e2ab359b", "hashmap": [{"hash": "584cd9e6927eaaa814c6545414f09911", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "cf46dbeffc0c7dc51130bcd388b4459a", "key": "references"}, {"hash": "92ee34fefd5301ff6ccb77b813c8d4f8", "key": "modified"}, {"hash": "86870277fcb3e3e121fe9e4f1f7c2b51", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "405ecfc0fb244283a2773863614145bf", "key": "cpe23"}, {"hash": "e63509ce8b627fb239a5a63969122026", "key": "cvss2"}, {"hash": "832b9c21b4589969549f63eb0724398c", "key": "cpe"}, {"hash": "0e66a595df2112e69adac8e55cbdb92d", "key": "cpeConfiguration"}, {"hash": "a97b191a26cb922c0b82d26c5f04f4db", "key": "affectedSoftware"}, {"hash": "ad35358d166de03a84a3a9280d95337a", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "073d5951cb97bd54baf9ef00e5950ef4", "key": "extraReferences"}, {"hash": "afd8c4a8002c25596504fc1efc107886", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6c607768196e3786ab17cb3a6e516cad", "key": "published"}, {"hash": "0b053db5674b87efff89989a8a720df3", "key": "cvss"}, {"hash": "756bd44ad36e62b951b7a08611cbd3f5", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "bc7f8fc71017e1124d57947313af5643", "key": "title"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "id": "CVE-2014-2595", "immutableFields": [], "lastseen": "2021-02-02T06:14:28", "modified": "2020-02-20T15:55:00", "objectVersion": "1.5", "published": "2020-02-12T01:15:00", "references": ["https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "http://www.osvdb.org/109782", "https://www.securityfocus.com/bid/69028", "https://www.exploit-db.com/exploits/39278", "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "http://seclists.org/fulldisclosure/2014/Aug/5"], "reporter": "cve@mitre.org", "title": "CVE-2014-2595", "type": "cve", "viewCount": 60}, "different_elements": ["cpeConfiguration"], "edition": 7, "lastseen": "2021-02-02T06:14:28"}], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2595", "enchantments": {"dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13887", "SECURITYVULNS:DOC:31004"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:127740"]}, {"type": "exploitdb", "idList": ["EDB-ID:39278"]}], "modified": "2021-04-22T23:44:08", "rev": 2}, "score": {"value": 6.9, "vector": "NONE", "modified": "2021-04-22T23:44:08", "rev": 2}}, "type": "cve", "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "a97b191a26cb922c0b82d26c5f04f4db"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "832b9c21b4589969549f63eb0724398c"}, {"key": "cpe23", "hash": "405ecfc0fb244283a2773863614145bf"}, {"key": "cpeConfiguration", "hash": "238f536d7ccbcb60d24ab76ed2548b8b"}, {"key": "cvelist", "hash": "afd8c4a8002c25596504fc1efc107886"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "e63509ce8b627fb239a5a63969122026"}, {"key": "cvss3", "hash": "ad35358d166de03a84a3a9280d95337a"}, {"key": "cwe", "hash": "86870277fcb3e3e121fe9e4f1f7c2b51"}, {"key": "description", "hash": "584cd9e6927eaaa814c6545414f09911"}, {"key": "extraReferences", "hash": "073d5951cb97bd54baf9ef00e5950ef4"}, {"key": "href", "hash": "756bd44ad36e62b951b7a08611cbd3f5"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "92ee34fefd5301ff6ccb77b813c8d4f8"}, {"key": "published", "hash": "6c607768196e3786ab17cb3a6e516cad"}, {"key": "references", "hash": "cf46dbeffc0c7dc51130bcd388b4459a"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "bc7f8fc71017e1124d57947313af5643"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "scheme": null, "affectedSoftware": [{"cpeName": "barracuda:web_application_firewall", "name": "barracuda web application firewall", "operator": "eq", "version": "7.8.1.013"}], "cpe": ["cpe:/a:barracuda:web_application_firewall:7.8.1.013"], "cpe23": ["cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*"], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cwe": ["CWE-613"], "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:barracuda:web_application_firewall:7.8.1.013:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004"}, {"name": "http://www.osvdb.org/109782", "refsource": "MISC", "tags": ["Broken Link"], "url": "http://www.osvdb.org/109782"}, {"name": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/", "refsource": "MISC", "tags": ["Broken Link"], "url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/"}, {"name": "https://www.exploit-db.com/exploits/39278", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/39278"}, {"name": "https://www.securityfocus.com/bid/69028", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "https://www.securityfocus.com/bid/69028"}, {"name": "http://seclists.org/fulldisclosure/2014/Aug/5", "refsource": "MISC", "tags": ["Third Party Advisory", "Mailing List", "Exploit"], "url": "http://seclists.org/fulldisclosure/2014/Aug/5"}], "immutableFields": []}, {"id": "CVE-2008-7273", "bulletinFamily": "NVD", "title": "CVE-2008-7273", "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "published": "2019-11-18T22:15:00", "modified": "2019-11-20T15:56:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "reporter": "cve@mitre.org", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "cvelist": ["CVE-2008-7273"], "type": "cve", "lastseen": "2021-04-21T20:41:43", "history": [{"bulletin": {"affectedSoftware": [{"name": "getfiregpg iceweasel-firegpg", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:getfiregpg:iceweasel-firegpg:-"], "cpe23": [], "cvelist": ["CVE-2008-7273"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-59"], "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "edition": 3, "enchantments": {"dependencies": {"modified": "2019-12-18T13:57:06", "references": [], "rev": 2}, "score": {"modified": "2019-12-18T13:57:06", "rev": 2, "value": 1.2, "vector": "NONE"}}, "hash": "d61e8c253c1f5d35ed5977532afcfe58d323a03057be4323e8c19bd7bed39d26", "hashmap": [{"hash": "368a4092894f1320c5eb8d6f1746c872", "key": "modified"}, {"hash": "d613e2c86955266b0d3e0b9be74eae16", "key": "references"}, {"hash": "b066b40875680d07f9f9912048360029", "key": "href"}, {"hash": "5a3d95049ed4485340188fd46566963d", "key": "title"}, {"hash": "9c6958cd5dd022a438c0a93346bb7717", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "3e1e24cf5fed13b85f5534cb239a1044", "key": "cpe"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "c92f044c94e4360fec268c45081f3bc6", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "4464888dd8ea79b7344278e86594f061", "key": "affectedSoftware"}, {"hash": "f427291f843f1948956af8f0777cb86f", "key": "description"}, {"hash": "d1c394bb6e6939e65900ac8652bcb35f", "key": "published"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "id": "CVE-2008-7273", "lastseen": "2019-12-18T13:57:06", "modified": "2019-11-20T15:56:00", "objectVersion": "1.3", "published": "2019-11-18T22:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "reporter": "cve@mitre.org", "title": "CVE-2008-7273", "type": "cve", "viewCount": 62}, "differentElements": ["cvss3", "cpe", "affectedSoftware"], "edition": 3, "lastseen": "2019-12-18T13:57:06"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:iceweasel-firegpg", "name": "getfiregpg iceweasel-firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {}, "cvelist": ["CVE-2008-7273"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-59"], "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-09-21T13:59:22", "references": [], "rev": 2}, "score": {"modified": "2020-09-21T13:59:22", "rev": 2, "value": 1.2, "vector": "NONE"}}, "hash": "557fd4cb813bf4897b5fdca93f953d2fe22dd9fed46f9a924ed2d03719983a4f", "hashmap": [{"hash": "beb519effad5780952ea4ce1697a49ad", "key": "cvss3"}, {"hash": "368a4092894f1320c5eb8d6f1746c872", "key": "modified"}, {"hash": "d613e2c86955266b0d3e0b9be74eae16", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b066b40875680d07f9f9912048360029", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "5a3d95049ed4485340188fd46566963d", "key": "title"}, {"hash": "9c6958cd5dd022a438c0a93346bb7717", "key": "cvelist"}, {"hash": "2323c5f10ea99bff6a3fd88adbf7723c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "c92f044c94e4360fec268c45081f3bc6", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f427291f843f1948956af8f0777cb86f", "key": "description"}, {"hash": "d1c394bb6e6939e65900ac8652bcb35f", "key": "published"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "id": "CVE-2008-7273", "lastseen": "2020-09-21T13:59:22", "modified": "2019-11-20T15:56:00", "objectVersion": "1.3", "published": "2019-11-18T22:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "reporter": "cve@mitre.org", "title": "CVE-2008-7273", "type": "cve", "viewCount": 62}, "differentElements": ["cpeConfiguration"], "edition": 4, "lastseen": "2020-09-21T13:59:22"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:iceweasel-firegpg", "name": "getfiregpg iceweasel-firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:iceweasel-firegpg:0.6:*:*:*:*:*:*:*", "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2008-7273"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-59"], "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "edition": 7, "enchantments": {"dependencies": {"modified": "2020-12-09T19:28:28", "references": [], "rev": 2}, "score": {"modified": "2020-12-09T19:28:28", "rev": 2, "value": 1.2, "vector": "NONE"}}, "extraReferences": [], "hash": "3f2537e658f4240fe6f7df8e451ce685d2ca8ba79fbda529c1842e690c507e37", "hashmap": [{"hash": "beb519effad5780952ea4ce1697a49ad", "key": "cvss3"}, {"hash": "368a4092894f1320c5eb8d6f1746c872", "key": "modified"}, {"hash": "d613e2c86955266b0d3e0b9be74eae16", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b066b40875680d07f9f9912048360029", "key": "href"}, {"hash": "5a3d95049ed4485340188fd46566963d", "key": "title"}, {"hash": "9c6958cd5dd022a438c0a93346bb7717", "key": "cvelist"}, {"hash": "2323c5f10ea99bff6a3fd88adbf7723c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "c92f044c94e4360fec268c45081f3bc6", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f427291f843f1948956af8f0777cb86f", "key": "description"}, {"hash": "d1c394bb6e6939e65900ac8652bcb35f", "key": "published"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}, {"hash": "451ac74d9ed8923574ac49d27fa22411", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "id": "CVE-2008-7273", "lastseen": "2020-12-09T19:28:28", "modified": "2019-11-20T15:56:00", "objectVersion": "1.3", "published": "2019-11-18T22:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "reporter": "cve@mitre.org", "title": "CVE-2008-7273", "type": "cve", "viewCount": 76}, "differentElements": ["extraReferences"], "edition": 7, "lastseen": "2020-12-09T19:28:28"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:iceweasel-firegpg", "name": "getfiregpg iceweasel-firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:iceweasel-firegpg:0.6:*:*:*:*:*:*:*", "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2008-7273"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-59"], "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "edition": 5, "enchantments": {"dependencies": {"modified": "2020-10-03T11:51:06", "references": [], "rev": 2}, "score": {"modified": "2020-10-03T11:51:06", "rev": 2, "value": 1.2, "vector": "NONE"}}, "hash": "3f49259ae0555553bcbf3433a53f5984d6de287f6d865e78b449bda3b88b8ea7", "hashmap": [{"hash": "beb519effad5780952ea4ce1697a49ad", "key": "cvss3"}, {"hash": "368a4092894f1320c5eb8d6f1746c872", "key": "modified"}, {"hash": "d613e2c86955266b0d3e0b9be74eae16", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b066b40875680d07f9f9912048360029", "key": "href"}, {"hash": "5a3d95049ed4485340188fd46566963d", "key": "title"}, {"hash": "9c6958cd5dd022a438c0a93346bb7717", "key": "cvelist"}, {"hash": "2323c5f10ea99bff6a3fd88adbf7723c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "c92f044c94e4360fec268c45081f3bc6", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f427291f843f1948956af8f0777cb86f", "key": "description"}, {"hash": "d1c394bb6e6939e65900ac8652bcb35f", "key": "published"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}, {"hash": "451ac74d9ed8923574ac49d27fa22411", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "id": "CVE-2008-7273", "lastseen": "2020-10-03T11:51:06", "modified": "2019-11-20T15:56:00", "objectVersion": "1.3", "published": "2019-11-18T22:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "reporter": "cve@mitre.org", "title": "CVE-2008-7273", "type": "cve", "viewCount": 72}, "differentElements": ["affectedSoftware"], "edition": 5, "lastseen": "2020-10-03T11:51:06"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:iceweasel-firegpg", "name": "getfiregpg iceweasel-firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:iceweasel-firegpg:0.6:*:*:*:*:*:*:*", "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2008-7273"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-59"], "description": "A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.", "edition": 8, "enchantments": {"dependencies": {"modified": "2021-02-02T05:35:21", "references": [], "rev": 2}, "score": {"modified": "2021-02-02T05:35:21", "rev": 2, "value": 1.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://www.openwall.com/lists/oss-security/2011/01/14/2", "refsource": "MISC", "tags": ["Third Party Advisory", "Mailing List"], "url": "https://www.openwall.com/lists/oss-security/2011/01/14/2"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"}, {"name": "https://security-tracker.debian.org/tracker/CVE-2008-7273", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2008-7273"}], "hash": "5b731cb69531a1a4f440c98e6086aef32b59d25a21b3e795f6d21cdd0acb5966", "hashmap": [{"hash": "beb519effad5780952ea4ce1697a49ad", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "368a4092894f1320c5eb8d6f1746c872", "key": "modified"}, {"hash": "d613e2c86955266b0d3e0b9be74eae16", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b066b40875680d07f9f9912048360029", "key": "href"}, {"hash": "85fdbb6779c8f53457b03e4617cac1fd", "key": "extraReferences"}, {"hash": "5a3d95049ed4485340188fd46566963d", "key": "title"}, {"hash": "9c6958cd5dd022a438c0a93346bb7717", "key": "cvelist"}, {"hash": "2323c5f10ea99bff6a3fd88adbf7723c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "c92f044c94e4360fec268c45081f3bc6", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "f427291f843f1948956af8f0777cb86f", "key": "description"}, {"hash": "d1c394bb6e6939e65900ac8652bcb35f", "key": "published"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}, {"hash": "451ac74d9ed8923574ac49d27fa22411", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7273", "id": "CVE-2008-7273", "immutableFields": [], "lastseen": "2021-02-02T05:35:21", "modified": "2019-11-20T15:56:00", "objectVersion": "1.5", "published": "2019-11-18T22:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7273", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "https://www.openwall.com/lists/oss-security/2011/01/14/2"], "reporter": "cve@mitre.org", "title": "CVE-2008-7273", "type": "cve", "viewCount": 78}, "different_elements": ["cpeConfiguration"], "edition": 8, "lastseen": "2021-02-02T05:35:21"}], "edition": 9, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "2323c5f10ea99bff6a3fd88adbf7723c"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpeConfiguration", "hash": "b37293c28011cded7e6cea212cc908fa"}, {"key": "cvelist", "hash": "9c6958cd5dd022a438c0a93346bb7717"}, {"key": "cvss", "hash": "6f6410364e4cee78bd47ed1fc3d8dd5b"}, {"key": "cvss2", "hash": "a6adb76bd2d2e833d4aee455da4b36c3"}, {"key": "cvss3", "hash": "beb519effad5780952ea4ce1697a49ad"}, {"key": "cwe", "hash": "c92f044c94e4360fec268c45081f3bc6"}, {"key": "description", "hash": "f427291f843f1948956af8f0777cb86f"}, {"key": "extraReferences", "hash": "85fdbb6779c8f53457b03e4617cac1fd"}, {"key": "href", "hash": "b066b40875680d07f9f9912048360029"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "368a4092894f1320c5eb8d6f1746c872"}, {"key": "published", "hash": "d1c394bb6e6939e65900ac8652bcb35f"}, {"key": "references", "hash": "d613e2c86955266b0d3e0b9be74eae16"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "5a3d95049ed4485340188fd46566963d"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "d695debc34a1657f10acd9dd2989cff4ec01e7bd03c81d546ca7db279f9ade48", "viewCount": 85, "enchantments": {"dependencies": {"references": [], "modified": "2021-04-21T20:41:43", "rev": 2}, "score": {"value": 1.2, "vector": "NONE", "modified": "2021-04-21T20:41:43", "rev": 2}}, "objectVersion": "1.5", "cpe": [], "affectedSoftware": [{"cpeName": "getfiregpg:iceweasel-firegpg", "name": "getfiregpg iceweasel-firegpg", "operator": "lt", "version": "0.6"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cpe23": [], "cwe": ["CWE-59"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:iceweasel-firegpg:0.6:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://www.openwall.com/lists/oss-security/2011/01/14/2", "refsource": "MISC", "tags": ["Third Party Advisory", "Mailing List"], "url": "https://www.openwall.com/lists/oss-security/2011/01/14/2"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"}, {"name": "https://security-tracker.debian.org/tracker/CVE-2008-7273", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2008-7273"}], "immutableFields": []}, {"id": "CVE-2019-16950", "bulletinFamily": "NVD", "title": "CVE-2019-16950", "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "published": "2019-11-13T19:15:00", "modified": "2019-11-15T19:11:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "reporter": "cve@mitre.org", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "cvelist": ["CVE-2019-16950"], "type": "cve", "lastseen": "2021-04-23T00:45:15", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.2.284.34"}, {"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.1.300.31"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:enghouse:web_chat:6.2.284.34", "cpe:/a:enghouse:web_chat:6.1.300.31"], "cpe23": ["cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2019-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-10-03T13:38:46", "references": [], "rev": 2}, "score": {"modified": "2020-10-03T13:38:46", "rev": 2, "value": 1.8, "vector": "NONE"}}, "extraReferences": [], "hash": "ac47654b34f5c624b85a2dba444ba3706c191479ff73a19fcc94d41a57afefde", "hashmap": [{"hash": "b8a74f419f4cee03e4fe1cd97d9992d9", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "b2c09af89019aad0a24ed1350dee3216", "key": "affectedSoftware"}, {"hash": "0b8b1da5f33a5e01663b588b76b08bfc", "key": "description"}, {"hash": "14d13b9b6346b514d8aae531eb55a55b", "key": "cpe23"}, {"hash": "d9bc3ed18a358b5c973d337b058487bf", "key": "references"}, {"hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "72b71c3ceccdc5ecd8d0a26bc60e12e5", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "996b47d04d0b0ac059fd6602ef3dfb3f", "key": "href"}, {"hash": "c50441512b9c3575ce8ffc2fc0891c36", "key": "cpeConfiguration"}, {"hash": "68d1c13a1077025d23359a3baf6d7cf0", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d79524472d90697b9a92d39c19491dce", "key": "cvss3"}, {"hash": "6c58de5c10966f7ad2d5d27830645761", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "id": "CVE-2019-16950", "lastseen": "2020-10-03T13:38:46", "modified": "2019-11-15T19:11:00", "objectVersion": "1.3", "published": "2019-11-13T19:15:00", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "reporter": "cve@mitre.org", "title": "CVE-2019-16950", "type": "cve", "viewCount": 2}, "differentElements": ["extraReferences"], "edition": 4, "lastseen": "2020-10-03T13:38:46"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.2.284.34"}, {"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.1.300.31"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:enghouse:web_chat:6.2.284.34", "cpe:/a:enghouse:web_chat:6.1.300.31"], "cpe23": ["cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2019-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-09-21T14:54:31", "references": [], "rev": 2}, "score": {"modified": "2020-09-21T14:54:31", "rev": 2, "value": 1.8, "vector": "NONE"}}, "hash": "84634d63553d0d01bc69728d161cebd50e34a0589fb47484f08ac692412ac0d8", "hashmap": [{"hash": "b8a74f419f4cee03e4fe1cd97d9992d9", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "b2c09af89019aad0a24ed1350dee3216", "key": "affectedSoftware"}, {"hash": "0b8b1da5f33a5e01663b588b76b08bfc", "key": "description"}, {"hash": "14d13b9b6346b514d8aae531eb55a55b", "key": "cpe23"}, {"hash": "d9bc3ed18a358b5c973d337b058487bf", "key": "references"}, {"hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "72b71c3ceccdc5ecd8d0a26bc60e12e5", "key": "modified"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "996b47d04d0b0ac059fd6602ef3dfb3f", "key": "href"}, {"hash": "68d1c13a1077025d23359a3baf6d7cf0", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d79524472d90697b9a92d39c19491dce", "key": "cvss3"}, {"hash": "6c58de5c10966f7ad2d5d27830645761", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "id": "CVE-2019-16950", "lastseen": "2020-09-21T14:54:31", "modified": "2019-11-15T19:11:00", "objectVersion": "1.3", "published": "2019-11-13T19:15:00", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "reporter": "cve@mitre.org", "title": "CVE-2019-16950", "type": "cve", "viewCount": 1}, "differentElements": ["cpeConfiguration"], "edition": 3, "lastseen": "2020-09-21T14:54:31"}, {"bulletin": {"affectedSoftware": [{"name": "enghouse web_chat", "operator": "eq", "version": "6.1.300.31"}, {"name": "enghouse web_chat", "operator": "eq", "version": "6.2.284.34"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:enghouse:web_chat:6.2.284.34", "cpe:/a:enghouse:web_chat:6.1.300.31"], "cpe23": ["cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*"], "cvelist": ["CVE-2019-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {}, "cwe": ["CWE-79"], "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "edition": 2, "enchantments": {"dependencies": {"modified": "2019-11-17T20:22:01", "references": [], "rev": 2}, "score": {"modified": "2019-11-17T20:22:01", "rev": 2, "value": 1.8, "vector": "NONE"}}, "hash": "bc5a2da8e1b26dac3050565f34c6f18f4f5a18b4ffffa35714d308df763739e0", "hashmap": [{"hash": "b8a74f419f4cee03e4fe1cd97d9992d9", "key": "cpe"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "904e09fa1d2873d4193e1d8de8620525", "key": "affectedSoftware"}, {"hash": "0b8b1da5f33a5e01663b588b76b08bfc", "key": "description"}, {"hash": "14d13b9b6346b514d8aae531eb55a55b", "key": "cpe23"}, {"hash": "d9bc3ed18a358b5c973d337b058487bf", "key": "references"}, {"hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "72b71c3ceccdc5ecd8d0a26bc60e12e5", "key": "modified"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "996b47d04d0b0ac059fd6602ef3dfb3f", "key": "href"}, {"hash": "68d1c13a1077025d23359a3baf6d7cf0", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "6c58de5c10966f7ad2d5d27830645761", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "id": "CVE-2019-16950", "lastseen": "2019-11-17T20:22:01", "modified": "2019-11-15T19:11:00", "objectVersion": "1.3", "published": "2019-11-13T19:15:00", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "reporter": "cve@mitre.org", "title": "CVE-2019-16950", "type": "cve", "viewCount": 1}, "differentElements": ["cvss3", "affectedSoftware"], "edition": 2, "lastseen": "2019-11-17T20:22:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.2.284.34"}, {"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.1.300.31"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:enghouse:web_chat:6.2.284.34", "cpe:/a:enghouse:web_chat:6.1.300.31"], "cpe23": ["cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2019-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "edition": 5, "enchantments": {"dependencies": {"modified": "2021-02-02T07:12:54", "references": [], "rev": 2}, "score": {"modified": "2021-02-02T07:12:54", "rev": 2, "value": 1.8, "vector": "NONE"}}, "extraReferences": [{"name": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"}], "hash": "043d32b9a5d837653a4e57ccb3d97d5a6d29721f79445d181f925a99bb63f420", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "b8a74f419f4cee03e4fe1cd97d9992d9", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "b2c09af89019aad0a24ed1350dee3216", "key": "affectedSoftware"}, {"hash": "0b8b1da5f33a5e01663b588b76b08bfc", "key": "description"}, {"hash": "14d13b9b6346b514d8aae531eb55a55b", "key": "cpe23"}, {"hash": "d9bc3ed18a358b5c973d337b058487bf", "key": "references"}, {"hash": "1b1cc60d5b8c32c412c6600856924d77", "key": "extraReferences"}, {"hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "72b71c3ceccdc5ecd8d0a26bc60e12e5", "key": "modified"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "996b47d04d0b0ac059fd6602ef3dfb3f", "key": "href"}, {"hash": "c50441512b9c3575ce8ffc2fc0891c36", "key": "cpeConfiguration"}, {"hash": "68d1c13a1077025d23359a3baf6d7cf0", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d79524472d90697b9a92d39c19491dce", "key": "cvss3"}, {"hash": "6c58de5c10966f7ad2d5d27830645761", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "id": "CVE-2019-16950", "immutableFields": [], "lastseen": "2021-02-02T07:12:54", "modified": "2019-11-15T19:11:00", "objectVersion": "1.5", "published": "2019-11-13T19:15:00", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "reporter": "cve@mitre.org", "title": "CVE-2019-16950", "type": "cve", "viewCount": 3}, "different_elements": ["cpeConfiguration"], "edition": 5, "lastseen": "2021-02-02T07:12:54"}, {"bulletin": {"affectedSoftware": [{"name": "enghouseinteractive web_chat", "operator": "eq", "version": "6.2.284.34"}, {"name": "enghouseinteractive web_chat", "operator": "eq", "version": "6.1.300.31"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:enghouseinteractive:web_chat:6.2.284.34", "cpe:/a:enghouseinteractive:web_chat:6.1.300.31"], "cpe23": ["cpe:2.3:a:enghouseinteractive:web_chat:6.2.284.34:*:*:*:*:*:*:*", "cpe:2.3:a:enghouseinteractive:web_chat:6.1.300.31:*:*:*:*:*:*:*"], "cvelist": ["CVE-2019-16950"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {}, "cwe": ["CWE-79"], "description": "An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-11-15T20:02:10", "references": []}, "score": {"modified": "2019-11-15T20:02:10", "value": 1.8, "vector": "NONE"}}, "hash": "828644290c026d010bad1f657397044d5acd1956d31ce52f41d63dbc781d0c02", "hashmap": [{"hash": "865aaa53d0e63c27f8996887f5caa253", "key": "cpe"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "fb6c0547ac7e56d23809c6ad4b8da6a3", "key": "cpe23"}, {"hash": "0b8b1da5f33a5e01663b588b76b08bfc", "key": "description"}, {"hash": "d9bc3ed18a358b5c973d337b058487bf", "key": "references"}, {"hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "996b47d04d0b0ac059fd6602ef3dfb3f", "key": "href"}, {"hash": "7ac143ece08c06a4de99de6b127fbeb5", "key": "modified"}, {"hash": "68d1c13a1077025d23359a3baf6d7cf0", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "6c58de5c10966f7ad2d5d27830645761", "key": "published"}, {"hash": "f0636bc4b443ebc46daa662bfeee19a6", "key": "affectedSoftware"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16950", "id": "CVE-2019-16950", "lastseen": "2019-11-15T20:02:10", "modified": "2019-11-14T20:45:00", "objectVersion": "1.3", "published": "2019-11-13T19:15:00", "references": ["https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"], "reporter": "cve@mitre.org", "title": "CVE-2019-16950", "type": "cve", "viewCount": 0}, "differentElements": ["cpe23", "modified", "cpe", "affectedSoftware"], "edition": 1, "lastseen": "2019-11-15T20:02:10"}], "edition": 6, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "b2c09af89019aad0a24ed1350dee3216"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "b8a74f419f4cee03e4fe1cd97d9992d9"}, {"key": "cpe23", "hash": "14d13b9b6346b514d8aae531eb55a55b"}, {"key": "cpeConfiguration", "hash": "016ef5cd548b20bc4bd3f47f9e03f639"}, {"key": "cvelist", "hash": "7eb46bb9e748cc2d3b4c6c7a773ba06b"}, {"key": "cvss", "hash": "f74a1c24e49a5ecb0eefb5e51d4caa14"}, {"key": "cvss2", "hash": "4419eb17de947d4d6b67ac07ed8d9064"}, {"key": "cvss3", "hash": "d79524472d90697b9a92d39c19491dce"}, {"key": "cwe", "hash": "34e69e045b64924bccf865d56b6918a2"}, {"key": "description", "hash": "0b8b1da5f33a5e01663b588b76b08bfc"}, {"key": "extraReferences", "hash": "1b1cc60d5b8c32c412c6600856924d77"}, {"key": "href", "hash": "996b47d04d0b0ac059fd6602ef3dfb3f"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "72b71c3ceccdc5ecd8d0a26bc60e12e5"}, {"key": "published", "hash": "6c58de5c10966f7ad2d5d27830645761"}, {"key": "references", "hash": "d9bc3ed18a358b5c973d337b058487bf"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "68d1c13a1077025d23359a3baf6d7cf0"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "1e71c53fdf3cf649eacb5ca953f60b98ae23b7b6b9f47d1c6642b9d7fdd1aa99", "viewCount": 6, "enchantments": {"dependencies": {"references": [], "modified": "2021-04-23T00:45:15", "rev": 2}, "score": {"value": 1.8, "vector": "NONE", "modified": "2021-04-23T00:45:15", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/a:enghouse:web_chat:6.2.284.34", "cpe:/a:enghouse:web_chat:6.1.300.31"], "affectedSoftware": [{"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.2.284.34"}, {"cpeName": "enghouse:web_chat", "name": "enghouse web chat", "operator": "eq", "version": "6.1.300.31"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cpe23": ["cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*"], "cwe": ["CWE-79"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.1.300.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:enghouse:web_chat:6.2.284.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat/"}], "immutableFields": []}, {"id": "CVE-2008-7272", "bulletinFamily": "NVD", "title": "CVE-2008-7272", "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "published": "2019-11-08T00:15:00", "modified": "2020-02-10T21:16:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "reporter": "cve@mitre.org", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "cvelist": ["CVE-2008-7272"], "type": "cve", "lastseen": "2021-04-21T20:41:43", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:firegpg", "name": "getfiregpg firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {}, "cvelist": ["CVE-2008-7272"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "cwe": ["CWE-312"], "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-09-21T13:59:22", "references": [], "rev": 2}, "score": {"modified": "2020-09-21T13:59:22", "rev": 2, "value": 2.4, "vector": "NONE"}}, "hash": "f6701a04d3477e440e72324b648d7646a2f9466e07e83e341707bb314aec84a0", "hashmap": [{"hash": "54b0c94164bf625d039c58f14cd4c116", "key": "references"}, {"hash": "92c16862fafe4d9eb26185434339836e", "key": "cwe"}, {"hash": "5db042f8057f3f288fe9cd4213121eb2", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "767e67f900c3effb5b550959d21fb12e", "key": "cvelist"}, {"hash": "3c75b36a7f1966a251dbe6148b866f97", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "9bc143c7676b7e5a3fd9537d7507310b", "key": "cvss2"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1162e82aa1c980ee7ebee4af4c99369c", "key": "published"}, {"hash": "cd391b15e7a01ae2bbfcca256d89bfb8", "key": "cvss3"}, {"hash": "95669953499c0eb40b242611dfbe75d4", "key": "description"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9258b012e591cc93a7c6b0cd1b5c6b05", "key": "href"}, {"hash": "a0acab3127efc281e78e28b6a414532c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "id": "CVE-2008-7272", "lastseen": "2020-09-21T13:59:22", "modified": "2020-02-10T21:16:00", "objectVersion": "1.3", "published": "2019-11-08T00:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "reporter": "cve@mitre.org", "title": "CVE-2008-7272", "type": "cve", "viewCount": 10}, "differentElements": ["cpeConfiguration"], "edition": 4, "lastseen": "2020-09-21T13:59:22"}, {"bulletin": {"affectedSoftware": [{"name": "getfiregpg firegpg", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:getfiregpg:firegpg:-"], "cpe23": [], "cvelist": ["CVE-2008-7272"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-312"], "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-02-11T14:25:16", "references": [], "rev": 2}, "score": {"modified": "2020-02-11T14:25:16", "rev": 2, "value": 2.4, "vector": "NONE"}}, "hash": "a5439a88032d0d96d6b3b175c5bb2652a08a5ac9dd8565abd675e989e312c52e", "hashmap": [{"hash": "54b0c94164bf625d039c58f14cd4c116", "key": "references"}, {"hash": "92c16862fafe4d9eb26185434339836e", "key": "cwe"}, {"hash": "5db042f8057f3f288fe9cd4213121eb2", "key": "title"}, {"hash": "767e67f900c3effb5b550959d21fb12e", "key": "cvelist"}, {"hash": "3c75b36a7f1966a251dbe6148b866f97", "key": "modified"}, {"hash": "9bc143c7676b7e5a3fd9537d7507310b", "key": "cvss2"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "c78a0c9b48c95bd2d49fb402de9ce674", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "1162e82aa1c980ee7ebee4af4c99369c", "key": "published"}, {"hash": "d2db9f7acf8121ca4d72b70e2934db08", "key": "affectedSoftware"}, {"hash": "95669953499c0eb40b242611dfbe75d4", "key": "description"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9258b012e591cc93a7c6b0cd1b5c6b05", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "id": "CVE-2008-7272", "lastseen": "2020-02-11T14:25:16", "modified": "2020-02-10T21:16:00", "objectVersion": "1.3", "published": "2019-11-08T00:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "reporter": "cve@mitre.org", "title": "CVE-2008-7272", "type": "cve", "viewCount": 10}, "differentElements": ["cvss3", "cpe", "affectedSoftware"], "edition": 3, "lastseen": "2020-02-11T14:25:16"}, {"bulletin": {"affectedSoftware": [{"name": "getfiregpg firegpg", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:getfiregpg:firegpg:-"], "cpe23": [], "cvelist": ["CVE-2008-7272"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["CWE-312"], "description": "FireGPG before 0.6 handle user?s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users?s private key.", "edition": 2, "enchantments": {"dependencies": {"modified": "2019-11-15T19:55:37", "references": []}, "score": {"modified": "2019-11-15T19:55:37", "value": 2.4, "vector": "NONE"}}, "hash": "05a389bab8cb239109f07a53e4f0a9c76cc24d31548b23dfad15c1385b48f5a5", "hashmap": [{"hash": "54b0c94164bf625d039c58f14cd4c116", "key": "references"}, {"hash": "92c16862fafe4d9eb26185434339836e", "key": "cwe"}, {"hash": "5db042f8057f3f288fe9cd4213121eb2", "key": "title"}, {"hash": "b0552313c96be75e9ec1c10adb56b096", "key": "modified"}, {"hash": "767e67f900c3effb5b550959d21fb12e", "key": "cvelist"}, {"hash": "9bc143c7676b7e5a3fd9537d7507310b", "key": "cvss2"}, {"hash": "240c2c1dd6f5cc5cbeb07774547c6c2b", "key": "description"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "c78a0c9b48c95bd2d49fb402de9ce674", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "1162e82aa1c980ee7ebee4af4c99369c", "key": "published"}, {"hash": "d2db9f7acf8121ca4d72b70e2934db08", "key": "affectedSoftware"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9258b012e591cc93a7c6b0cd1b5c6b05", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "id": "CVE-2008-7272", "lastseen": "2019-11-15T19:55:37", "modified": "2019-11-14T14:28:00", "objectVersion": "1.3", "published": "2019-11-08T00:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "reporter": "cve@mitre.org", "title": "CVE-2008-7272", "type": "cve", "viewCount": 2}, "differentElements": ["description", "modified"], "edition": 2, "lastseen": "2019-11-15T19:55:37"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:firegpg", "name": "getfiregpg firegpg", "operator": "lt", "version": "0.6"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:firegpg:0.6:*:*:*:*:firefox:*:*", "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2008-7272"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "cwe": ["CWE-312"], "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "edition": 8, "enchantments": {"dependencies": {"modified": "2021-02-02T05:35:21", "references": [], "rev": 2}, "score": {"modified": "2021-02-02T05:35:21", "rev": 2, "value": 2.4, "vector": "NONE"}}, "extraReferences": [{"name": "https://security-tracker.debian.org/tracker/CVE-2008-7272", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2008-7272"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"}, {"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "refsource": "MISC", "tags": ["Third Party Advisory", "Issue Tracking"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386"}], "hash": "feff88852d5f44ef4f736cb629de97022a0e3f23b99e0deec3d9ee5daaa7d8df", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "54b0c94164bf625d039c58f14cd4c116", "key": "references"}, {"hash": "4847e3110691b6a6a4c7664c0f127f70", "key": "extraReferences"}, {"hash": "92c16862fafe4d9eb26185434339836e", "key": "cwe"}, {"hash": "5db042f8057f3f288fe9cd4213121eb2", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "767e67f900c3effb5b550959d21fb12e", "key": "cvelist"}, {"hash": "3c75b36a7f1966a251dbe6148b866f97", "key": "modified"}, {"hash": "9bc143c7676b7e5a3fd9537d7507310b", "key": "cvss2"}, {"hash": "675695b80d1f3d2196a77047e1ceba64", "key": "cpeConfiguration"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1162e82aa1c980ee7ebee4af4c99369c", "key": "published"}, {"hash": "cd391b15e7a01ae2bbfcca256d89bfb8", "key": "cvss3"}, {"hash": "95669953499c0eb40b242611dfbe75d4", "key": "description"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9258b012e591cc93a7c6b0cd1b5c6b05", "key": "href"}, {"hash": "a0acab3127efc281e78e28b6a414532c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "id": "CVE-2008-7272", "immutableFields": [], "lastseen": "2021-02-02T05:35:21", "modified": "2020-02-10T21:16:00", "objectVersion": "1.5", "published": "2019-11-08T00:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "reporter": "cve@mitre.org", "title": "CVE-2008-7272", "type": "cve", "viewCount": 19}, "different_elements": ["cpeConfiguration"], "edition": 8, "lastseen": "2021-02-02T05:35:21"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "getfiregpg:firegpg", "name": "getfiregpg firegpg", "operator": "lt", "version": "*"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:firegpg:0.6:*:*:*:*:firefox:*:*", "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2008-7272"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "cwe": ["CWE-312"], "description": "FireGPG before 0.6 handle user\u2019s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users\u2019s private key.", "edition": 6, "enchantments": {"dependencies": {"modified": "2020-11-29T22:56:16", "references": [], "rev": 2}, "score": {"modified": "2020-11-29T22:56:16", "rev": 2, "value": 2.4, "vector": "NONE"}}, "hash": "20ae55db346f6babbeac989b07a5b26e855e45e42cfda6773d64bbcb84e4ef79", "hashmap": [{"hash": "d647e62c83e294ffd6f56a7c761beece", "key": "affectedSoftware"}, {"hash": "54b0c94164bf625d039c58f14cd4c116", "key": "references"}, {"hash": "92c16862fafe4d9eb26185434339836e", "key": "cwe"}, {"hash": "5db042f8057f3f288fe9cd4213121eb2", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "767e67f900c3effb5b550959d21fb12e", "key": "cvelist"}, {"hash": "3c75b36a7f1966a251dbe6148b866f97", "key": "modified"}, {"hash": "9bc143c7676b7e5a3fd9537d7507310b", "key": "cvss2"}, {"hash": "675695b80d1f3d2196a77047e1ceba64", "key": "cpeConfiguration"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1162e82aa1c980ee7ebee4af4c99369c", "key": "published"}, {"hash": "cd391b15e7a01ae2bbfcca256d89bfb8", "key": "cvss3"}, {"hash": "95669953499c0eb40b242611dfbe75d4", "key": "description"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9258b012e591cc93a7c6b0cd1b5c6b05", "key": "href"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-7272", "id": "CVE-2008-7272", "lastseen": "2020-11-29T22:56:16", "modified": "2020-02-10T21:16:00", "objectVersion": "1.3", "published": "2019-11-08T00:15:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2008-7272", "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"], "reporter": "cve@mitre.org", "title": "CVE-2008-7272", "type": "cve", "viewCount": 15}, "differentElements": ["affectedSoftware"], "edition": 6, "lastseen": "2020-11-29T22:56:16"}], "edition": 9, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "a0acab3127efc281e78e28b6a414532c"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpeConfiguration", "hash": "77e03828e2d6f83f8fa932acfe8daff3"}, {"key": "cvelist", "hash": "767e67f900c3effb5b550959d21fb12e"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "cvss2", "hash": "9bc143c7676b7e5a3fd9537d7507310b"}, {"key": "cvss3", "hash": "cd391b15e7a01ae2bbfcca256d89bfb8"}, {"key": "cwe", "hash": "92c16862fafe4d9eb26185434339836e"}, {"key": "description", "hash": "95669953499c0eb40b242611dfbe75d4"}, {"key": "extraReferences", "hash": "4847e3110691b6a6a4c7664c0f127f70"}, {"key": "href", "hash": "9258b012e591cc93a7c6b0cd1b5c6b05"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "3c75b36a7f1966a251dbe6148b866f97"}, {"key": "published", "hash": "1162e82aa1c980ee7ebee4af4c99369c"}, {"key": "references", "hash": "54b0c94164bf625d039c58f14cd4c116"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "5db042f8057f3f288fe9cd4213121eb2"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "f34f5d089606f7d870ccc28642bf61f774619d905673726848fc15f3a6590575", "viewCount": 25, "enchantments": {"dependencies": {"references": [], "modified": "2021-04-21T20:41:43", "rev": 2}, "score": {"value": 2.4, "vector": "NONE", "modified": "2021-04-21T20:41:43", "rev": 2}}, "objectVersion": "1.5", "cpe": [], "affectedSoftware": [{"cpeName": "getfiregpg:firegpg", "name": "getfiregpg firegpg", "operator": "lt", "version": "0.6"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, "cpe23": [], "cwe": ["CWE-312"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:getfiregpg:firegpg:0.6:*:*:*:*:firefox:*:*", "cpe_name": [], "versionEndExcluding": "0.6", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://security-tracker.debian.org/tracker/CVE-2008-7272", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://security-tracker.debian.org/tracker/CVE-2008-7272"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20757?utm_source=securityvulns&utm_medium=redirect"}, {"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386", "refsource": "MISC", "tags": ["Third Party Advisory", "Issue Tracking"], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514386"}], "immutableFields": []}, {"id": "CVE-2015-9286", "bulletinFamily": "NVD", "title": "CVE-2015-9286", "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "published": "2019-04-30T14:29:00", "modified": "2019-05-01T14:22:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "reporter": "cve@mitre.org", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "cvelist": ["CVE-2015-9286"], "type": "cve", "lastseen": "2021-04-22T23:51:50", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "0.7.3"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:nodebb:nodebb:0.7.3:*:*:*:*:*:*:*", "versionEndExcluding": "0.7.3", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2015-9286"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "edition": 6, "enchantments": {"dependencies": {"modified": "2021-02-02T06:21:32", "references": [{"idList": ["SECURITYVULNS:DOC:32625"], "type": "securityvulns"}, {"idList": ["GHSA-72FV-QGJ6-2W2P"], "type": "github"}], "rev": 2}, "score": {"modified": "2021-02-02T06:21:32", "rev": 2, "value": 1.4, "vector": "NONE"}}, "extraReferences": [{"name": "https://github.com/NodeBB/NodeBB/pull/3371", "refsource": "MISC", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NodeBB/NodeBB/pull/3371"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"}, {"name": "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "refsource": "MISC", "tags": ["Third Party Advisory", "Release Notes"], "url": "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529"}, {"name": "https://www.vulnerability-lab.com/get_content.php?id=1608", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://www.vulnerability-lab.com/get_content.php?id=1608"}], "hash": "e0413d958386f6534538918bca2249dcc4f383174e07b3bfd828fd87bab2fae7", "hashmap": [{"hash": "cabb6b89504f33d4cae5fb66665d6372", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "f9048d548aea2a33f8c8fe44e8c9817c", "key": "cvss3"}, {"hash": "4d53af7f522025f16113d72d1dd86a79", "key": "published"}, {"hash": "0ac6deaa5a07331e3db4762cb458fde6", "key": "href"}, {"hash": "db8254901fea804d4d910fc508c1be32", "key": "extraReferences"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7bcda725e0fe4634bd741d18870efc86", "key": "description"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "8e5a048329755897094215f117301c63", "key": "modified"}, {"hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295", "key": "cvelist"}, {"hash": "dac3bc07a427ceea0c7680630fcafbdf", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6e87bbaab34c901324df8e163b451120", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "587727297bf29a06aaafbf1f31d41b9a", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "id": "CVE-2015-9286", "immutableFields": [], "lastseen": "2021-02-02T06:21:32", "modified": "2019-05-01T14:22:00", "objectVersion": "1.5", "published": "2019-04-30T14:29:00", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "reporter": "cve@mitre.org", "title": "CVE-2015-9286", "type": "cve", "viewCount": 10}, "different_elements": ["cpeConfiguration"], "edition": 6, "lastseen": "2021-02-02T06:21:32"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "0.7.3"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {}, "cvelist": ["CVE-2015-9286"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-09-21T14:09:33", "references": [{"idList": ["SECURITYVULNS:DOC:32625"], "type": "securityvulns"}, {"idList": ["GHSA-72FV-QGJ6-2W2P"], "type": "github"}], "rev": 2}, "score": {"modified": "2020-09-21T14:09:33", "rev": 2, "value": 1.4, "vector": "NONE"}}, "hash": "e856f7b9491cefcc50723678fc0433f12f7c6ae1abe16d206957fd00f74aa6e1", "hashmap": [{"hash": "cabb6b89504f33d4cae5fb66665d6372", "key": "affectedSoftware"}, {"hash": "f9048d548aea2a33f8c8fe44e8c9817c", "key": "cvss3"}, {"hash": "4d53af7f522025f16113d72d1dd86a79", "key": "published"}, {"hash": "0ac6deaa5a07331e3db4762cb458fde6", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7bcda725e0fe4634bd741d18870efc86", "key": "description"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "8e5a048329755897094215f117301c63", "key": "modified"}, {"hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295", "key": "cvelist"}, {"hash": "dac3bc07a427ceea0c7680630fcafbdf", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6e87bbaab34c901324df8e163b451120", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "id": "CVE-2015-9286", "lastseen": "2020-09-21T14:09:33", "modified": "2019-05-01T14:22:00", "objectVersion": "1.3", "published": "2019-04-30T14:29:00", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "reporter": "cve@mitre.org", "title": "CVE-2015-9286", "type": "cve", "viewCount": 4}, "differentElements": ["cpeConfiguration"], "edition": 2, "lastseen": "2020-09-21T14:09:33"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "0.7.3"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:nodebb:nodebb:0.7.3:*:*:*:*:*:*:*", "versionEndExcluding": "0.7.3", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2015-9286"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "edition": 5, "enchantments": {"dependencies": {"modified": "2020-12-09T20:03:10", "references": [{"idList": ["SECURITYVULNS:DOC:32625"], "type": "securityvulns"}, {"idList": ["GHSA-72FV-QGJ6-2W2P"], "type": "github"}], "rev": 2}, "score": {"modified": "2020-12-09T20:03:10", "rev": 2, "value": 1.4, "vector": "NONE"}}, "extraReferences": [], "hash": "48b94d9acf0e692c61f3d939f819f0ddba91180b8a5c7286e7edbacc4207d0ed", "hashmap": [{"hash": "cabb6b89504f33d4cae5fb66665d6372", "key": "affectedSoftware"}, {"hash": "f9048d548aea2a33f8c8fe44e8c9817c", "key": "cvss3"}, {"hash": "4d53af7f522025f16113d72d1dd86a79", "key": "published"}, {"hash": "0ac6deaa5a07331e3db4762cb458fde6", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7bcda725e0fe4634bd741d18870efc86", "key": "description"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "8e5a048329755897094215f117301c63", "key": "modified"}, {"hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295", "key": "cvelist"}, {"hash": "dac3bc07a427ceea0c7680630fcafbdf", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6e87bbaab34c901324df8e163b451120", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "587727297bf29a06aaafbf1f31d41b9a", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "id": "CVE-2015-9286", "lastseen": "2020-12-09T20:03:10", "modified": "2019-05-01T14:22:00", "objectVersion": "1.3", "published": "2019-04-30T14:29:00", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "reporter": "cve@mitre.org", "title": "CVE-2015-9286", "type": "cve", "viewCount": 6}, "differentElements": ["extraReferences"], "edition": 5, "lastseen": "2020-12-09T20:03:10"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "*"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:nodebb:nodebb:0.7.3:*:*:*:*:*:*:*", "versionEndExcluding": "0.7.3", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2015-9286"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-11-30T00:13:43", "references": [{"idList": ["SECURITYVULNS:DOC:32625"], "type": "securityvulns"}, {"idList": ["GHSA-72FV-QGJ6-2W2P"], "type": "github"}], "rev": 2}, "score": {"modified": "2020-11-30T00:13:43", "rev": 2, "value": 1.4, "vector": "NONE"}}, "hash": "6fe52c24d63e23f00822e673ee4063d867fb4719b46c47ea85a6bfe1400fe129", "hashmap": [{"hash": "f9048d548aea2a33f8c8fe44e8c9817c", "key": "cvss3"}, {"hash": "4d53af7f522025f16113d72d1dd86a79", "key": "published"}, {"hash": "0ac6deaa5a07331e3db4762cb458fde6", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7bcda725e0fe4634bd741d18870efc86", "key": "description"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "8e5a048329755897094215f117301c63", "key": "modified"}, {"hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295", "key": "cvelist"}, {"hash": "dac3bc07a427ceea0c7680630fcafbdf", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "71d5df73a226d76c990527e0ca95c8d8", "key": "affectedSoftware"}, {"hash": "6e87bbaab34c901324df8e163b451120", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "587727297bf29a06aaafbf1f31d41b9a", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "id": "CVE-2015-9286", "lastseen": "2020-11-30T00:13:43", "modified": "2019-05-01T14:22:00", "objectVersion": "1.3", "published": "2019-04-30T14:29:00", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "reporter": "cve@mitre.org", "title": "CVE-2015-9286", "type": "cve", "viewCount": 5}, "differentElements": ["affectedSoftware"], "edition": 4, "lastseen": "2020-11-30T00:13:43"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "0.7.3"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:nodebb:nodebb:0.7.3:*:*:*:*:*:*:*", "versionEndExcluding": "0.7.3", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2015-9286"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cwe": ["CWE-79"], "description": "Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T12:49:59", "references": [{"idList": ["SECURITYVULNS:DOC:32625"], "type": "securityvulns"}, {"idList": ["GHSA-72FV-QGJ6-2W2P"], "type": "github"}], "rev": 2}, "score": {"modified": "2020-10-03T12:49:59", "rev": 2, "value": 1.4, "vector": "NONE"}}, "hash": "a933ff7201764471adcb8ac53cabee44c82a081f537a97f7fcd01cbed62795ec", "hashmap": [{"hash": "cabb6b89504f33d4cae5fb66665d6372", "key": "affectedSoftware"}, {"hash": "f9048d548aea2a33f8c8fe44e8c9817c", "key": "cvss3"}, {"hash": "4d53af7f522025f16113d72d1dd86a79", "key": "published"}, {"hash": "0ac6deaa5a07331e3db4762cb458fde6", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7bcda725e0fe4634bd741d18870efc86", "key": "description"}, {"hash": "4419eb17de947d4d6b67ac07ed8d9064", "key": "cvss2"}, {"hash": "8e5a048329755897094215f117301c63", "key": "modified"}, {"hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295", "key": "cvelist"}, {"hash": "dac3bc07a427ceea0c7680630fcafbdf", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "34e69e045b64924bccf865d56b6918a2", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "6e87bbaab34c901324df8e163b451120", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "f74a1c24e49a5ecb0eefb5e51d4caa14", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "587727297bf29a06aaafbf1f31d41b9a", "key": "cpeConfiguration"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9286", "id": "CVE-2015-9286", "lastseen": "2020-10-03T12:49:59", "modified": "2019-05-01T14:22:00", "objectVersion": "1.3", "published": "2019-04-30T14:29:00", "references": ["https://github.com/NodeBB/NodeBB/pull/3371", "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "https://www.vulnerability-lab.com/get_content.php?id=1608", "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"], "reporter": "cve@mitre.org", "title": "CVE-2015-9286", "type": "cve", "viewCount": 5}, "differentElements": ["affectedSoftware"], "edition": 3, "lastseen": "2020-10-03T12:49:59"}], "edition": 7, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "cabb6b89504f33d4cae5fb66665d6372"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpeConfiguration", "hash": "f9e1afb4d3a36011638be68c9582e6b5"}, {"key": "cvelist", "hash": "f964d0f7ddcfa3fb2eb8853d2a1e7295"}, {"key": "cvss", "hash": "f74a1c24e49a5ecb0eefb5e51d4caa14"}, {"key": "cvss2", "hash": "4419eb17de947d4d6b67ac07ed8d9064"}, {"key": "cvss3", "hash": "f9048d548aea2a33f8c8fe44e8c9817c"}, {"key": "cwe", "hash": "34e69e045b64924bccf865d56b6918a2"}, {"key": "description", "hash": "7bcda725e0fe4634bd741d18870efc86"}, {"key": "extraReferences", "hash": "db8254901fea804d4d910fc508c1be32"}, {"key": "href", "hash": "0ac6deaa5a07331e3db4762cb458fde6"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "8e5a048329755897094215f117301c63"}, {"key": "published", "hash": "4d53af7f522025f16113d72d1dd86a79"}, {"key": "references", "hash": "dac3bc07a427ceea0c7680630fcafbdf"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "6e87bbaab34c901324df8e163b451120"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "6e9080b6a871ad58f0d05298373de4fe9c9158a2d86ff7f1a34e720d353d3e7b", "viewCount": 14, "enchantments": {"dependencies": {"references": [{"type": "github", "idList": ["GHSA-72FV-QGJ6-2W2P"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32625"]}], "modified": "2021-04-22T23:51:50", "rev": 2}, "score": {"value": 1.4, "vector": "NONE", "modified": "2021-04-22T23:51:50", "rev": 2}}, "objectVersion": "1.5", "cpe": [], "affectedSoftware": [{"cpeName": "nodebb:nodebb", "name": "nodebb", "operator": "lt", "version": "0.7.3"}], "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, "cpe23": [], "cwe": ["CWE-79"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nodebb:nodebb:0.7.3:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "0.7.3", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://github.com/NodeBB/NodeBB/pull/3371", "refsource": "MISC", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NodeBB/NodeBB/pull/3371"}, {"name": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32625"}, {"name": "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529", "refsource": "MISC", "tags": ["Third Party Advisory", "Release Notes"], "url": "https://github.com/NodeBB/NodeBB/compare/56b79a9...4de7529"}, {"name": "https://www.vulnerability-lab.com/get_content.php?id=1608", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit"], "url": "https://www.vulnerability-lab.com/get_content.php?id=1608"}], "immutableFields": []}, {"id": "CVE-2018-16950", "bulletinFamily": "NVD", "title": "CVE-2018-16950", "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "published": "2018-09-12T02:29:00", "modified": "2020-08-24T17:37:00", "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "reporter": "cve@mitre.org", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "cvelist": ["CVE-2018-16950"], "type": "cve", "lastseen": "2021-04-23T00:24:20", "history": [{"bulletin": {"affectedSoftware": [{"name": "inteno dg400_firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "cpe23": [], "cvelist": ["CVE-2018-16950"], "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-08-26T19:28:01", "references": [], "rev": 2}, "score": {"modified": "2020-08-26T19:28:01", "rev": 2, "value": 6.3, "vector": "NONE"}}, "hash": "5bdb93ffcc0bbd02d714aebfcf038acd99f86f8892b5b8489b97209ce4e25c4a", "hashmap": [{"hash": "1a61810f2bdf8921788e3bc10477c6f9", "key": "cvss2"}, {"hash": "bec10d575791183362df84e0fb8c77d0", "key": "references"}, {"hash": "3a91c9a140d1667e99780b6d5c5ebaad", "key": "cvss3"}, {"hash": "5df0cbc8aa96d0c3a2702b7ed41dfb77", "key": "modified"}, {"hash": "01e69fc83cb251fc312c773587db5583", "key": "published"}, {"hash": "b428a7c64022b62f67e3d4d0b0581536", "key": "description"}, {"hash": "f60638ed56604a7bd93f51a09d314724", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "98c08074da8aaca6af3906c60486197f", "key": "cvss"}, {"hash": "c16ae1b9e2187deb2ae82bbd1ac7ad2c", "key": "affectedSoftware"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "ad5ea5a4109209230c2ef0b50ff61df8", "key": "cpe"}, {"hash": "1127593c6ae87d6bbeafee13feab4cc7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "869d97d8324a50c37376f5a51437d740", "key": "cvelist"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "id": "CVE-2018-16950", "lastseen": "2020-08-26T19:28:01", "modified": "2020-08-24T17:37:00", "objectVersion": "1.3", "published": "2018-09-12T02:29:00", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "reporter": "cve@mitre.org", "title": "CVE-2018-16950", "type": "cve", "viewCount": 2}, "differentElements": ["cpe23", "cpe", "affectedSoftware"], "edition": 2, "lastseen": "2020-08-26T19:28:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "inteno:dg400_firmware", "name": "inteno dg400 firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "cpe23": ["cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2018-16950"], "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-09-21T14:29:00", "references": [], "rev": 2}, "score": {"modified": "2020-09-21T14:29:00", "rev": 2, "value": 6.3, "vector": "NONE"}}, "hash": "3df94640075c715f2b5c71a34e85458b0785226e97722d57573ed7500849d7a2", "hashmap": [{"hash": "1a61810f2bdf8921788e3bc10477c6f9", "key": "cvss2"}, {"hash": "0b06297bc333012dd897a54b21a9c0d1", "key": "cpe23"}, {"hash": "bec10d575791183362df84e0fb8c77d0", "key": "references"}, {"hash": "3a91c9a140d1667e99780b6d5c5ebaad", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "5df0cbc8aa96d0c3a2702b7ed41dfb77", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "01e69fc83cb251fc312c773587db5583", "key": "published"}, {"hash": "b428a7c64022b62f67e3d4d0b0581536", "key": "description"}, {"hash": "f60638ed56604a7bd93f51a09d314724", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "98c08074da8aaca6af3906c60486197f", "key": "cvss"}, {"hash": "8802251174b239af825a8de5781b856c", "key": "affectedSoftware"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5d2b915a01401bcb828b2276a711b3bd", "key": "cpe"}, {"hash": "1127593c6ae87d6bbeafee13feab4cc7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "869d97d8324a50c37376f5a51437d740", "key": "cvelist"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "id": "CVE-2018-16950", "lastseen": "2020-09-21T14:29:00", "modified": "2020-08-24T17:37:00", "objectVersion": "1.3", "published": "2018-09-12T02:29:00", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "reporter": "cve@mitre.org", "title": "CVE-2018-16950", "type": "cve", "viewCount": 2}, "differentElements": ["affectedConfiguration", "cpeConfiguration"], "edition": 3, "lastseen": "2020-09-21T14:29:00"}, {"bulletin": {"affectedConfiguration": [{"cpeName": "inteno:dg400", "name": "inteno dg400", "operator": "eq", "version": "-"}], "affectedSoftware": [{"cpeName": "inteno:dg400_firmware", "name": "inteno dg400 firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "cpe23": ["cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:h:inteno:dg400:-:*:*:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}, {"cpe_match": [{"cpe23Uri": "cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "AND"}]}, "cvelist": ["CVE-2018-16950"], "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-10-03T13:20:16", "references": [], "rev": 2}, "score": {"modified": "2020-10-03T13:20:16", "rev": 2, "value": 6.3, "vector": "NONE"}}, "extraReferences": [], "hash": "826aee48733629c0678a3f8295e3dfbdc1021ef1ead896eab5b9f50706876df3", "hashmap": [{"hash": "1a61810f2bdf8921788e3bc10477c6f9", "key": "cvss2"}, {"hash": "0b06297bc333012dd897a54b21a9c0d1", "key": "cpe23"}, {"hash": "bec10d575791183362df84e0fb8c77d0", "key": "references"}, {"hash": "3a91c9a140d1667e99780b6d5c5ebaad", "key": "cvss3"}, {"hash": "5df0cbc8aa96d0c3a2702b7ed41dfb77", "key": "modified"}, {"hash": "01e69fc83cb251fc312c773587db5583", "key": "published"}, {"hash": "b428a7c64022b62f67e3d4d0b0581536", "key": "description"}, {"hash": "73ce771638cd503382e947fc8dab1584", "key": "affectedConfiguration"}, {"hash": "f60638ed56604a7bd93f51a09d314724", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "98c08074da8aaca6af3906c60486197f", "key": "cvss"}, {"hash": "8802251174b239af825a8de5781b856c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "318e9d13f9e6f7873f18c5ce654eb09b", "key": "cpeConfiguration"}, {"hash": "5d2b915a01401bcb828b2276a711b3bd", "key": "cpe"}, {"hash": "1127593c6ae87d6bbeafee13feab4cc7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "869d97d8324a50c37376f5a51437d740", "key": "cvelist"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "id": "CVE-2018-16950", "lastseen": "2020-10-03T13:20:16", "modified": "2020-08-24T17:37:00", "objectVersion": "1.3", "published": "2018-09-12T02:29:00", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "reporter": "cve@mitre.org", "title": "CVE-2018-16950", "type": "cve", "viewCount": 3}, "differentElements": ["extraReferences"], "edition": 4, "lastseen": "2020-10-03T13:20:16"}, {"bulletin": {"affectedConfiguration": [{"cpeName": "inteno:dg400", "name": "inteno dg400", "operator": "eq", "version": "-"}], "affectedSoftware": [{"cpeName": "inteno:dg400_firmware", "name": "inteno dg400 firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "cpe23": ["cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:h:inteno:dg400:-:*:*:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}, {"cpe_match": [{"cpe23Uri": "cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "AND"}]}, "cvelist": ["CVE-2018-16950"], "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["NVD-CWE-noinfo"], "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "edition": 5, "enchantments": {"dependencies": {"modified": "2021-02-02T06:52:32", "references": [], "rev": 2}, "score": {"modified": "2021-02-02T06:52:32", "rev": 2, "value": 6.3, "vector": "NONE"}}, "extraReferences": [{"name": "https://twitter.com/cyberarchconsul/status/1039682695826169857", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://twitter.com/cyberarchconsul/status/1039682695826169857"}], "hash": "b32bad7132591dabc76bc014ef9a0e9589c2f7849b15ba9e7a43cc2c73cfe060", "hashmap": [{"hash": "1a61810f2bdf8921788e3bc10477c6f9", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "0b06297bc333012dd897a54b21a9c0d1", "key": "cpe23"}, {"hash": "bec10d575791183362df84e0fb8c77d0", "key": "references"}, {"hash": "3a91c9a140d1667e99780b6d5c5ebaad", "key": "cvss3"}, {"hash": "5df0cbc8aa96d0c3a2702b7ed41dfb77", "key": "modified"}, {"hash": "01e69fc83cb251fc312c773587db5583", "key": "published"}, {"hash": "b428a7c64022b62f67e3d4d0b0581536", "key": "description"}, {"hash": "73ce771638cd503382e947fc8dab1584", "key": "affectedConfiguration"}, {"hash": "f60638ed56604a7bd93f51a09d314724", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "98c08074da8aaca6af3906c60486197f", "key": "cvss"}, {"hash": "8949246ca6f1f5c6b641feefbe3ca2ff", "key": "extraReferences"}, {"hash": "8802251174b239af825a8de5781b856c", "key": "affectedSoftware"}, {"hash": "d370d473ba1bd1721d669ef98e2aeebb", "key": "cwe"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "318e9d13f9e6f7873f18c5ce654eb09b", "key": "cpeConfiguration"}, {"hash": "5d2b915a01401bcb828b2276a711b3bd", "key": "cpe"}, {"hash": "1127593c6ae87d6bbeafee13feab4cc7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "869d97d8324a50c37376f5a51437d740", "key": "cvelist"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "id": "CVE-2018-16950", "immutableFields": [], "lastseen": "2021-02-02T06:52:32", "modified": "2020-08-24T17:37:00", "objectVersion": "1.5", "published": "2018-09-12T02:29:00", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "reporter": "cve@mitre.org", "title": "CVE-2018-16950", "type": "cve", "viewCount": 4}, "different_elements": ["cpeConfiguration"], "edition": 5, "lastseen": "2021-02-02T06:52:32"}, {"bulletin": {"affectedSoftware": [{"name": "inteno dg400_firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "cpe23": [], "cvelist": ["CVE-2018-16950"], "cvss": {"score": 3.3, "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cwe": ["CWE-20"], "description": "Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:19:52", "references": [], "rev": 2}, "score": {"modified": "2019-05-29T18:19:52", "rev": 2, "value": 6.3, "vector": "NONE"}}, "hash": "b52d00cf2301c93e7d75d096534979ce3e71838fae5969f3110f47bfa7ade99b", "hashmap": [{"hash": "1a61810f2bdf8921788e3bc10477c6f9", "key": "cvss2"}, {"hash": "bec10d575791183362df84e0fb8c77d0", "key": "references"}, {"hash": "3a91c9a140d1667e99780b6d5c5ebaad", "key": "cvss3"}, {"hash": "226da5129ffaaee3d5b48e506b957d58", "key": "cwe"}, {"hash": "01e69fc83cb251fc312c773587db5583", "key": "published"}, {"hash": "b428a7c64022b62f67e3d4d0b0581536", "key": "description"}, {"hash": "f60638ed56604a7bd93f51a09d314724", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "98c08074da8aaca6af3906c60486197f", "key": "cvss"}, {"hash": "c16ae1b9e2187deb2ae82bbd1ac7ad2c", "key": "affectedSoftware"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "cf6dd522c51c6fcce0369fb19f682f43", "key": "modified"}, {"hash": "ad5ea5a4109209230c2ef0b50ff61df8", "key": "cpe"}, {"hash": "1127593c6ae87d6bbeafee13feab4cc7", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "869d97d8324a50c37376f5a51437d740", "key": "cvelist"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16950", "id": "CVE-2018-16950", "lastseen": "2019-05-29T18:19:52", "modified": "2018-11-27T18:32:00", "objectVersion": "1.3", "published": "2018-09-12T02:29:00", "references": ["https://twitter.com/cyberarchconsul/status/1039682695826169857"], "reporter": "cve@mitre.org", "title": "CVE-2018-16950", "type": "cve", "viewCount": 2}, "differentElements": ["modified", "cwe"], "edition": 1, "lastseen": "2019-05-29T18:19:52"}], "edition": 6, "hashmap": [{"key": "affectedConfiguration", "hash": "73ce771638cd503382e947fc8dab1584"}, {"key": "affectedSoftware", "hash": "8802251174b239af825a8de5781b856c"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "5d2b915a01401bcb828b2276a711b3bd"}, {"key": "cpe23", "hash": "0b06297bc333012dd897a54b21a9c0d1"}, {"key": "cpeConfiguration", "hash": "0c4e7ecb570baa71f34b007578c44cd5"}, {"key": "cvelist", "hash": "869d97d8324a50c37376f5a51437d740"}, {"key": "cvss", "hash": "98c08074da8aaca6af3906c60486197f"}, {"key": "cvss2", "hash": "1a61810f2bdf8921788e3bc10477c6f9"}, {"key": "cvss3", "hash": "3a91c9a140d1667e99780b6d5c5ebaad"}, {"key": "cwe", "hash": "d370d473ba1bd1721d669ef98e2aeebb"}, {"key": "description", "hash": "b428a7c64022b62f67e3d4d0b0581536"}, {"key": "extraReferences", "hash": "8949246ca6f1f5c6b641feefbe3ca2ff"}, {"key": "href", "hash": "f60638ed56604a7bd93f51a09d314724"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "5df0cbc8aa96d0c3a2702b7ed41dfb77"}, {"key": "published", "hash": "01e69fc83cb251fc312c773587db5583"}, {"key": "references", "hash": "bec10d575791183362df84e0fb8c77d0"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "1127593c6ae87d6bbeafee13feab4cc7"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "4aaf499a3bd1d5141716afc6ab28da8bf902d5aa22cd3e84703e2214f6b7c98c", "viewCount": 7, "enchantments": {"dependencies": {"references": [], "modified": "2021-04-23T00:24:20", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-04-23T00:24:20", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328"], "affectedSoftware": [{"cpeName": "inteno:dg400_firmware", "name": "inteno dg400 firmware", "operator": "eq", "version": "wu7u_elion3.11.6-170614_1328"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "cpe23": ["cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-noinfo"], "scheme": null, "affectedConfiguration": [{"cpeName": "inteno:dg400", "name": "inteno dg400", "operator": "eq", "version": "-"}], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:h:inteno:dg400:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}], "operator": "OR"}, {"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:inteno:dg400_firmware:wu7u_elion3.11.6-170614_1328:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}], "cpe_match": [], "operator": "AND"}]}, "extraReferences": [{"name": "https://twitter.com/cyberarchconsul/status/1039682695826169857", "refsource": "MISC", "tags": ["Third Party Advisory"], "url": "https://twitter.com/cyberarchconsul/status/1039682695826169857"}], "immutableFields": []}], "mscve": [{"id": "MS:CVE-2020-16950", "hash": "0c39e766430a53195178a018e87300df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-10-06T10:48:58", "history": [{"bulletin": {"id": "MS:CVE-2020-16950", "hash": "9f2beb599d894f6fc6447ad89e20fb72e52f0927ec758336981406c3a8d38d7f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2020-10-13T21:02:54", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"modified": "2020-10-13T21:02:54", "references": [{"idList": ["CVE-2020-16950"], "type": "cve"}, {"idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"], "type": "nessus"}, {"idList": ["KLA11976"], "type": "kaspersky"}], "rev": 2}, "score": {"modified": "2020-10-13T21:02:54", "rev": 2, "value": 5.5, "vector": "NONE"}}, "objectVersion": "1.4", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"kb": "KB4486676", "kbSupersedence": "KB4484505", "msplatform": "", "name": "Microsoft SharePoint Server 2019"}], "vendorCvss": {}}, "lastseen": "2020-10-13T21:02:54", "differentElements": ["cvss"], "edition": 1}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "a50dd4d42ad0171e40b024a6abe79ff0", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2020-10-21T13:28:41", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2020-10-21T13:28:41", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2020-10-21T13:28:41", "rev": 2}}, "objectVersion": "1.4", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"kb": "KB4486676", "kbSupersedence": "KB4484505", "msplatform": "", "name": "Microsoft SharePoint Server 2019"}], "vendorCvss": {}}, "lastseen": "2020-10-21T13:28:41", "differentElements": ["href"], "edition": 2}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "94966e792a0f2c92bc0f48add161f80e", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-03-18T19:15:01", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-03-18T19:15:01", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-03-18T19:15:01", "rev": 2}}, "objectVersion": "1.5", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-03-18T19:15:01", "differentElements": ["cvss2", "cvss3"], "edition": 3}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-07-28T20:07:00", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-07-28T20:07:00", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-07-28T20:07:00", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-07-28T20:07:00", "differentElements": ["msAffectedSoftware"], "edition": 4}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-03T18:46:41", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-03T18:46:41", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-03T18:46:41", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-03T18:46:41", "differentElements": ["msAffectedSoftware"], "edition": 5}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-03T20:42:18", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-03T20:42:18", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-03T20:42:18", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-03T20:42:18", "differentElements": ["msAffectedSoftware"], "edition": 6}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-04T06:47:13", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-04T06:47:13", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-04T06:47:13", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T06:47:13", "differentElements": ["msAffectedSoftware"], "edition": 7}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-04T08:47:11", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-04T08:47:11", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-04T08:47:11", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T08:47:11", "differentElements": ["msAffectedSoftware"], "edition": 8}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-04T14:45:52", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-04T14:45:52", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-04T14:45:52", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T14:45:52", "differentElements": ["msAffectedSoftware"], "edition": 9}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-04T16:51:10", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-04T16:51:10", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-04T16:51:10", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T16:51:10", "differentElements": ["msAffectedSoftware"], "edition": 10}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-05T06:46:26", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-05T06:46:26", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-05T06:46:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T06:46:26", "differentElements": ["msAffectedSoftware"], "edition": 11}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-05T08:49:01", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-05T08:49:01", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-05T08:49:01", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T08:49:01", "differentElements": ["msAffectedSoftware"], "edition": 12}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-05T18:46:06", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-05T18:46:06", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-05T18:46:06", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T18:46:06", "differentElements": ["msAffectedSoftware"], "edition": 13}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-05T20:48:18", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-05T20:48:18", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-05T20:48:18", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T20:48:18", "differentElements": ["msAffectedSoftware"], "edition": 14}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-06T10:43:20", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-06T10:43:20", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-06T10:43:20", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T10:43:20", "differentElements": ["msAffectedSoftware"], "edition": 15}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-06T12:49:32", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-06T12:49:32", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-06T12:49:32", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T12:49:32", "differentElements": ["msAffectedSoftware"], "edition": 16}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-06T16:54:01", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-06T16:54:01", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-06T16:54:01", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T16:54:01", "differentElements": ["msAffectedSoftware"], "edition": 17}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-06T18:44:58", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-06T18:44:58", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-06T18:44:58", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T18:44:58", "differentElements": ["msAffectedSoftware"], "edition": 18}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-07T08:43:26", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-07T08:43:26", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-07T08:43:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-07T08:43:26", "differentElements": ["msAffectedSoftware"], "edition": 19}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-07T10:44:11", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-07T10:44:11", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-07T10:44:11", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-07T10:44:11", "differentElements": ["msAffectedSoftware"], "edition": 20}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-08T14:45:07", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-08T14:45:07", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-08T14:45:07", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-08T14:45:07", "differentElements": ["msAffectedSoftware"], "edition": 21}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-08T16:54:32", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-08T16:54:32", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-08T16:54:32", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-08T16:54:32", "differentElements": ["msAffectedSoftware"], "edition": 22}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-09T05:01:50", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112738", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112737"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-08T16:54:32", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-08T16:54:32", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-09T05:01:50", "differentElements": ["msAffectedSoftware"], "edition": 23}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-09T06:50:14", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-09T06:50:14", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-09T06:50:14", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-09T06:50:14", "differentElements": ["msAffectedSoftware"], "edition": 24}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-10T08:45:22", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-09T06:50:14", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-09T06:50:14", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T08:45:22", "differentElements": ["msAffectedSoftware"], "edition": 25}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-10T10:44:19", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-09T06:50:14", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-09T06:50:14", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T10:44:19", "differentElements": ["msAffectedSoftware"], "edition": 26}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-10T18:58:38", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-09T06:50:14", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-09T06:50:14", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T18:58:38", "differentElements": ["msAffectedSoftware"], "edition": 27}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-10T20:44:33", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-09T06:50:14", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-09T06:50:14", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T20:44:33", "differentElements": ["msAffectedSoftware"], "edition": 28}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T08:47:48", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T08:47:48", "differentElements": ["msAffectedSoftware"], "edition": 29}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T11:22:24", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T11:22:24", "differentElements": ["msAffectedSoftware"], "edition": 30}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T12:51:48", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T12:51:48", "differentElements": ["msAffectedSoftware"], "edition": 31}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T15:07:47", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T15:07:47", "differentElements": ["msAffectedSoftware"], "edition": 32}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T16:47:52", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T16:47:52", "differentElements": ["msAffectedSoftware"], "edition": 33}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T19:04:26", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T19:04:26", "differentElements": ["msAffectedSoftware"], "edition": 34}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T20:47:01", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T08:47:48", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T08:47:48", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T20:47:01", "differentElements": ["msAffectedSoftware"], "edition": 35}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-11T22:53:36", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T22:53:36", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T22:53:36", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-11T22:53:36", "differentElements": ["msAffectedSoftware"], "edition": 36}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "afd1f51eb68e29f8aca1823b9813abcc", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-12T04:44:19", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL", "WEB_APPLICATION_SCANNING_112739"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-11T22:53:36", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-11T22:53:36", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-12T04:44:19", "differentElements": ["msAffectedSoftware"], "edition": 37}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-12T06:50:46", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-12T06:50:46", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-12T06:50:46", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-12T06:50:46", "differentElements": ["msAffectedSoftware"], "edition": 38}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-12T20:49:32", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-12T06:50:46", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-12T06:50:46", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-12T20:49:32", "differentElements": ["msAffectedSoftware"], "edition": 39}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-12T22:47:04", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-12T06:50:46", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-12T06:50:46", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-12T22:47:04", "differentElements": ["msAffectedSoftware"], "edition": 40}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-13T00:46:17", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-12T06:50:46", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-12T06:50:46", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4486676", "KB4484505"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}, {"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-13T00:46:17", "differentElements": ["msAffectedSoftware"], "edition": 41}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "b69f883473015b28624a6dbeb185dbb9", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-13T04:50:40", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-16950"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112737", "WEB_APPLICATION_SCANNING_112740", "WEB_APPLICATION_SCANNING_112739", "WEB_APPLICATION_SCANNING_112738", "SMB_NT_MS20_OCT_OFFICE_SHAREPOINT_2019.NASL"]}, {"type": "mskb", "idList": ["KB4486676"]}, {"type": "kaspersky", "idList": ["KLA11976"]}], "modified": "2021-09-12T06:50:46", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-09-12T06:50:46", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB4484505", "KB4486676"], "msrc": "", "mscve": "CVE-2020-16950", "msAffectedSoftware": [{"name": "Microsoft SharePoint Server 2019", "kbSupersedence": "KB4484505", "kb": "KB4486676", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-13T04:50:40", "differentElements": ["msAffectedSoftware"], "edition": 42}, {"bulletin": {"id": "MS:CVE-2020-16950", "hash": "fb4bfbbf0209c326baa04e06d30d8a8f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Microsoft SharePoint Information Disclosure Vulnerability", "description": "An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user\u2019s system.\n\nTo exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.\n\nThe security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.\n", "published": "2020-10-13T07:00:00", "modified": "2020-10-13T07:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16950", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2020-16950"], "immutableFields": [], "lastseen": "2021-09-13T06:59:38&q