Microsoft Sharepoint Server

stack.watch can email you when security vulnerabilities are reported in Microsoft Sharepoint Server. You can add multiple products that you use with Sharepoint Server to create your own personal software stack watcher.

@sharepoint Tweets

Visit the #MicrosoftLists adoption page to get resources that can help you increase Lists awareness and usage in yo… https://t.co/jySvz9Mwv0
Thu Feb 25 17:44:38 +0000 2021

RT @MSTCommunity: .@jeffteper shares how #Microsoft365 engineering teams are incorporating customer input and feedback at every stage of pr…
Thu Feb 25 16:20:18 +0000 2021

�� Great #SharePoint community call demo by @Meltorac on the latest around the app bar and hub sites ✅ User persona… https://t.co/l3dR0sxCW5
Thu Feb 25 14:15:00 +0000 2021

RT @MS_Ignite: Microsoft wants to hear from you! Join a Product Roundtable at #MSIgnite to help shape the future of products you use every…
Thu Feb 25 01:50:11 +0000 2021

By the Year

In 2021 there have been 7 vulnerabilities in Microsoft Sharepoint Server with an average score of 7.3 out of ten. Last year Sharepoint Server had 113 security vulnerabilities published. Right now, Sharepoint Server is on track to have less security vulnerabilities in 2021 than it did last year. However, the average CVE base score of the vulnerabilities in 2021 is greater by 0.60.

Year	Vulnerabilities	Average Score
2021	7	7.31
2020	113	6.71
2019	33	6.77
2018	25	6.46

It may take a day or so for new Sharepoint Server vulnerabilities to show up. Additionally vulnerabilities may be tagged under a different product or component name.

Latest Microsoft Sharepoint Server Security Vulnerabilities

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique

CVE-2021-1716 7.8 - High - January 12, 2021

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1715.

CVE-2021-1716 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique

CVE-2021-1715 7.8 - High - January 12, 2021

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1716.

CVE-2021-1715 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Out-of-bounds Write

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2021-1641 5.4 - Medium - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2021-1717.

CVE-2021-1641 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique

CVE-2021-1712 8 - High - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1719.

CVE-2021-1712 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.1 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Privilege Management

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2021-1717 5.4 - Medium - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2021-1641.

CVE-2021-1717 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique

CVE-2021-1719 8 - High - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1712.

CVE-2021-1719 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.1 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Privilege Management

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2021-1707 8.8 - High - January 12, 2021

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2021-1707 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17122 7.8 - High - December 10, 2020

Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17123, CVE-2020-17125, CVE-2020-17127, CVE-2020-17128, CVE-2020-17129.

CVE-2020-17122 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2020-17089 8 - High - December 10, 2020

Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2020-17089 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.1 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Privilege Management

Microsoft SharePoint Spoofing Vulnerability

CVE-2020-17115 8 - High - December 10, 2020

Microsoft SharePoint Spoofing Vulnerability

CVE-2020-17115 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.1 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Input Validation

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17118 9.8 - Critical - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17121.

CVE-2020-17118 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Microsoft SharePoint Information Disclosure Vulnerability

CVE-2020-17120 6.5 - Medium - December 10, 2020

Microsoft SharePoint Information Disclosure Vulnerability

CVE-2020-17120 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17121 8.8 - High - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17118.

CVE-2020-17121 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17060 5.4 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17016.

CVE-2020-17060 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2020-17061 8.8 - High - November 11, 2020

Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2020-17061 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique

CVE-2020-16979 6.5 - Medium - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-17017.

CVE-2020-16979 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17015 6.5 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17016, CVE-2020-17060.

CVE-2020-17015 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Improper Input Validation

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17016 8.8 - High - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2020-17015, CVE-2020-17060.

CVE-2020-17016 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Input Validation

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique

CVE-2020-17017 6.5 - Medium - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16979.

CVE-2020-17017 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-16929 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16930, CVE-2020-16931, CVE-2020-16932.

CVE-2020-16929 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Dangling pointer

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16953 6.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16941, CVE-2020-16942, CVE-2020-16948, CVE-2020-16950.

CVE-2020-16953 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages

CVE-2020-16941 5.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, aka 'Microsoft SharePoint Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-16942, CVE-2020-16948, CVE-2020-16950, CVE-2020-16953.

CVE-2020-16941 can be explotited with local system access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages

CVE-2020-16942 4.4 - Medium - October 16, 2020

CVE-2020-16942 is exploitable with local system access, and requires user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 0.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server

CVE-2020-16944 5.4 - Medium - October 16, 2020

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'.

CVE-2020-16944 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-16945 5.4 - Medium - October 16, 2020

CVE-2020-16945 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-16946 5.4 - Medium - October 16, 2020

CVE-2020-16946 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16948 6.5 - Medium - October 16, 2020

CVE-2020-16948 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16950 5.5 - Medium - October 16, 2020

CVE-2020-16950 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-16951 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16952.

CVE-2020-16951 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Origin Validation Error

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-16952 7.8 - High - October 16, 2020

CVE-2020-16952 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Origin Validation Error

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1576 8.8 - High - September 11, 2020

CVE-2020-1576 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Download of Code Without Integrity Check

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1218 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1338.

CVE-2020-1218 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Control of Generation of Code ('Code Injection')

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data

CVE-2020-1440 4.3 - Medium - September 11, 2020

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data, aka 'Microsoft SharePoint Server Tampering Vulnerability'. This CVE ID is unique from CVE-2020-1523.

CVE-2020-1440 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Improper Input Validation

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1198 6.1 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1227, CVE-2020-1345, CVE-2020-1482, CVE-2020-1514, CVE-2020-1575.

CVE-2020-1198 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1200 8.6 - High - September 11, 2020

CVE-2020-1200 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.

Download of Code Without Integrity Check

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1210 8.8 - High - September 11, 2020

CVE-2020-1210 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Download of Code Without Integrity Check

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1227 5.4 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198, CVE-2020-1345, CVE-2020-1482, CVE-2020-1514, CVE-2020-1575.

CVE-2020-1227 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-1335 8.8 - High - September 11, 2020

CVE-2020-1335 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1345 6.1 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198, CVE-2020-1227, CVE-2020-1482, CVE-2020-1514, CVE-2020-1575.

CVE-2020-1345 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1452 8.6 - High - September 11, 2020

CVE-2020-1452 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.

Download of Code Without Integrity Check

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1453 8.6 - High - September 11, 2020

CVE-2020-1453 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.

Download of Code Without Integrity Check

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1482 6.1 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198, CVE-2020-1227, CVE-2020-1345, CVE-2020-1514, CVE-2020-1575.

CVE-2020-1482 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1514 5.4 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198, CVE-2020-1227, CVE-2020-1345, CVE-2020-1482, CVE-2020-1575.

CVE-2020-1514 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected

CVE-2020-1595 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200, CVE-2020-1210, CVE-2020-1452, CVE-2020-1453, CVE-2020-1576.

CVE-2020-1595 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Download of Code Without Integrity Check

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1205 4.6 - Medium - September 11, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'.

CVE-2020-1205 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.1 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1338 8.8 - High - September 11, 2020

CVE-2020-1338 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Control of Generation of Code ('Code Injection')

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls

CVE-2020-1460 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

CVE-2020-1460 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data

CVE-2020-1523 4.3 - Medium - September 11, 2020

CVE-2020-1523 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-1495 8.8 - High - August 17, 2020

CVE-2020-1495 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1500 5.4 - Medium - August 17, 2020

CVE-2020-1500 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1501 5.4 - Medium - August 17, 2020

CVE-2020-1501 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1503 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory, aka 'Microsoft Word Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1502, CVE-2020-1583.

CVE-2020-1503 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-1505 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory, aka 'Microsoft SharePoint Information Disclosure Vulnerability'.

CVE-2020-1505 can be explotited with local system access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1580 5.4 - Medium - August 17, 2020

CVE-2020-1580 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1583 5.5 - Medium - August 17, 2020

CVE-2020-1583 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1502 5.5 - Medium - August 17, 2020

CVE-2020-1502 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1499 5.4 - Medium - August 17, 2020

CVE-2020-1499 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Improper Input Validation

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1573 5.4 - Medium - August 17, 2020

CVE-2020-1573 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1446 8.8 - High - July 14, 2020

CVE-2020-1446 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1450 5.4 - Medium - July 14, 2020

CVE-2020-1450 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1451 5.4 - Medium - July 14, 2020

CVE-2020-1451 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1447 8.8 - High - July 14, 2020

CVE-2020-1447 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input

CVE-2020-1439 8.8 - High - July 14, 2020

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution Vulnerability'.

CVE-2020-1439 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Marshaling, Unmarshaling

A remote code execution vulnerability exists in .NET Framework

CVE-2020-1147 7.8 - High - July 14, 2020

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

CVE-2020-1147 can be explotited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable

CVE-2020-1342 5.5 - Medium - July 14, 2020

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka 'Microsoft Office Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-1445.

CVE-2020-1342 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Use of Uninitialized Resource

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1456 5.4 - Medium - July 14, 2020

CVE-2020-1456 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation

CVE-2020-1025 9.8 - Critical - July 14, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation, aka 'Microsoft Office Elevation of Privilege Vulnerability'.

CVE-2020-1025 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Improper Privilege Management

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1448 8.8 - High - July 14, 2020

CVE-2020-1448 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1443 5.4 - Medium - July 14, 2020

CVE-2020-1443 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Downstream Injection

A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages

CVE-2020-1444 4.3 - Medium - July 14, 2020

A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.

CVE-2020-1444 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Improper Input Validation

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server

CVE-2020-1454 5.4 - Medium - July 14, 2020

CVE-2020-1454 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server

CVE-2020-1178 8.8 - High - June 09, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka 'Microsoft SharePoint Server Elevation of Privilege Vulnerability'.

CVE-2020-1178 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Privilege Management

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1148 5.4 - Medium - June 09, 2020

CVE-2020-1148 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

An open redirect vulnerability exists in Microsoft SharePoint

CVE-2020-1323 6.1 - Medium - June 09, 2020

An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link, aka 'SharePoint Open Redirect Vulnerability'.

CVE-2020-1323 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Open Redirect

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1298 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1318, CVE-2020-1320.

CVE-2020-1298 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1318 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1320.

CVE-2020-1318 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1320 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318.

CVE-2020-1320 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1297 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.

CVE-2020-1297 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1177 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.

CVE-2020-1177 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1183 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.

CVE-2020-1183 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls

CVE-2020-1181 8.8 - High - June 09, 2020

CVE-2020-1181 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Input Validation

An elevation of privilege vulnerability exists in Microsoft SharePoint

CVE-2020-1295 8.8 - High - June 09, 2020

An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.

CVE-2020-1295 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Privilege Management

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1100 5.4 - Medium - May 21, 2020

CVE-2020-1100 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1105 5.4 - Medium - May 21, 2020

CVE-2020-1105 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1024 8.8 - High - May 21, 2020

CVE-2020-1024 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Unrestricted File Upload

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1099 5.4 - Medium - May 21, 2020

CVE-2020-1099 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1101 5.4 - Medium - May 21, 2020

CVE-2020-1101 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1023 8.8 - High - May 21, 2020

CVE-2020-1023 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Unrestricted File Upload

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1102 8.8 - High - May 21, 2020

CVE-2020-1102 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Unrestricted File Upload

An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker

CVE-2020-1103 6.5 - Medium - May 21, 2020

An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF).When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard browser functionality, induce the browser to invoke search queries as the logged in user, aka 'Microsoft SharePoint Information Disclosure Vulnerability'.

CVE-2020-1103 can be explotited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1104 5.4 - Medium - May 21, 2020

CVE-2020-1104 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1107 5.4 - Medium - May 21, 2020

CVE-2020-1107 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1106 6.1 - Medium - May 21, 2020

CVE-2020-1106 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls

CVE-2020-1069 8.8 - High - May 21, 2020

CVE-2020-1069 can be explotited with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-0973 5.4 - Medium - April 15, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0978.

CVE-2020-0973 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-0980 7.8 - High - April 15, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.

CVE-2020-0980 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Memory Corruption

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-0920 8.8 - High - April 15, 2020

CVE-2020-0920 is exploitable with network access, and requires small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Unrestricted File Upload

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-0923 5.4 - Medium - April 15, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

CVE-2020-0923 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-0924 5.4 - Medium - April 15, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

CVE-2020-0924 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-0925 5.4 - Medium - April 15, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

CVE-2020-0925 can be explotited with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

Microsoft Sharepoint Server

@sharepoint Tweets

By the Year

Latest Microsoft Sharepoint Server Security Vulnerabilities

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique CVE-2021-1716 7.8 - High - January 12, 2021

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique CVE-2021-1715 7.8 - High - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique CVE-2021-1641 5.4 - Medium - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique CVE-2021-1712 8 - High - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique CVE-2021-1717 5.4 - Medium - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique CVE-2021-1719 8 - High - January 12, 2021

Microsoft SharePoint Server Remote Code Execution Vulnerability CVE-2021-1707 8.8 - High - January 12, 2021

Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique CVE-2020-17122 7.8 - High - December 10, 2020

Microsoft SharePoint Elevation of Privilege Vulnerability CVE-2020-17089 8 - High - December 10, 2020

Microsoft SharePoint Spoofing Vulnerability CVE-2020-17115 8 - High - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique CVE-2020-17118 9.8 - Critical - December 10, 2020

Microsoft SharePoint Information Disclosure Vulnerability CVE-2020-17120 6.5 - Medium - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique CVE-2020-17121 8.8 - High - December 10, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique CVE-2020-17060 5.4 - Medium - November 11, 2020

Microsoft SharePoint Remote Code Execution Vulnerability CVE-2020-17061 8.8 - High - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique CVE-2020-16979 6.5 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique CVE-2020-17015 6.5 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique CVE-2020-17016 8.8 - High - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique CVE-2020-17017 6.5 - Medium - November 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory CVE-2020-16929 7.8 - High - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory CVE-2020-16953 6.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages CVE-2020-16941 5.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages CVE-2020-16942 4.4 - Medium - October 16, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-16945 5.4 - Medium - October 16, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-16946 5.4 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory CVE-2020-16948 6.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory CVE-2020-16950 5.5 - Medium - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-16951 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-16952 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-1576 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory CVE-2020-1218 8.8 - High - September 11, 2020

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data CVE-2020-1440 4.3 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1198 6.1 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-1200 8.6 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-1210 8.8 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1227 5.4 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory CVE-2020-1335 8.8 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1345 6.1 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-1452 8.6 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package CVE-2020-1453 8.6 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1482 6.1 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1514 5.4 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected CVE-2020-1595 8.8 - High - September 11, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1205 4.6 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory CVE-2020-1338 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls CVE-2020-1460 8.8 - High - September 11, 2020

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data CVE-2020-1523 4.3 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory CVE-2020-1495 8.8 - High - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1500 5.4 - Medium - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1501 5.4 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory CVE-2020-1503 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory CVE-2020-1505 5.5 - Medium - August 17, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1580 5.4 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory CVE-2020-1583 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory CVE-2020-1502 5.5 - Medium - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1499 5.4 - Medium - August 17, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1573 5.4 - Medium - August 17, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory CVE-2020-1446 8.8 - High - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1450 5.4 - Medium - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1451 5.4 - Medium - July 14, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory CVE-2020-1447 8.8 - High - July 14, 2020

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input CVE-2020-1439 8.8 - High - July 14, 2020

A remote code execution vulnerability exists in .NET Framework CVE-2020-1147 7.8 - High - July 14, 2020

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable CVE-2020-1342 5.5 - Medium - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1456 5.4 - Medium - July 14, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation CVE-2020-1025 9.8 - Critical - July 14, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory CVE-2020-1448 8.8 - High - July 14, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1443 5.4 - Medium - July 14, 2020

A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages CVE-2020-1444 4.3 - Medium - July 14, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server CVE-2020-1178 8.8 - High - June 09, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1148 5.4 - Medium - June 09, 2020

An open redirect vulnerability exists in Microsoft SharePoint CVE-2020-1323 6.1 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1298 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1318 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1320 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server CVE-2020-1297 5.4 - Medium - June 09, 2020

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique

CVE-2021-1716 7.8 - High - January 12, 2021

Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique

CVE-2021-1715 7.8 - High - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2021-1641 5.4 - Medium - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique

CVE-2021-1712 8 - High - January 12, 2021

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2021-1717 5.4 - Medium - January 12, 2021

Microsoft SharePoint Elevation of Privilege Vulnerability This CVE ID is unique

CVE-2021-1719 8 - High - January 12, 2021

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2021-1707 8.8 - High - January 12, 2021

Microsoft Excel Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17122 7.8 - High - December 10, 2020

Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2020-17089 8 - High - December 10, 2020

Microsoft SharePoint Spoofing Vulnerability

CVE-2020-17115 8 - High - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17118 9.8 - Critical - December 10, 2020

Microsoft SharePoint Information Disclosure Vulnerability

CVE-2020-17120 6.5 - Medium - December 10, 2020

Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique

CVE-2020-17121 8.8 - High - December 10, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17060 5.4 - Medium - November 11, 2020

Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2020-17061 8.8 - High - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique

CVE-2020-16979 6.5 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17015 6.5 - Medium - November 11, 2020

Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique

CVE-2020-17016 8.8 - High - November 11, 2020

Microsoft SharePoint Information Disclosure Vulnerability This CVE ID is unique

CVE-2020-17017 6.5 - Medium - November 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-16929 7.8 - High - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16953 6.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages

CVE-2020-16941 5.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages

CVE-2020-16942 4.4 - Medium - October 16, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-16945 5.4 - Medium - October 16, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-16946 5.4 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16948 6.5 - Medium - October 16, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-16950 5.5 - Medium - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-16951 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-16952 7.8 - High - October 16, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1576 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1218 8.8 - High - September 11, 2020

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data

CVE-2020-1440 4.3 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1198 6.1 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1200 8.6 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1210 8.8 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1227 5.4 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-1335 8.8 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1345 6.1 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1452 8.6 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package

CVE-2020-1453 8.6 - High - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1482 6.1 - Medium - September 11, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1514 5.4 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected

CVE-2020-1595 8.8 - High - September 11, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1205 4.6 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1338 8.8 - High - September 11, 2020

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls

CVE-2020-1460 8.8 - High - September 11, 2020

A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data

CVE-2020-1523 4.3 - Medium - September 11, 2020

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory

CVE-2020-1495 8.8 - High - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1500 5.4 - Medium - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1501 5.4 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1503 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory

CVE-2020-1505 5.5 - Medium - August 17, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1580 5.4 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1583 5.5 - Medium - August 17, 2020

An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory

CVE-2020-1502 5.5 - Medium - August 17, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1499 5.4 - Medium - August 17, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1573 5.4 - Medium - August 17, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1446 8.8 - High - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1450 5.4 - Medium - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1451 5.4 - Medium - July 14, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1447 8.8 - High - July 14, 2020

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input

CVE-2020-1439 8.8 - High - July 14, 2020

A remote code execution vulnerability exists in .NET Framework

CVE-2020-1147 7.8 - High - July 14, 2020

An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable

CVE-2020-1342 5.5 - Medium - July 14, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1456 5.4 - Medium - July 14, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token validation

CVE-2020-1025 9.8 - Critical - July 14, 2020

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory

CVE-2020-1448 8.8 - High - July 14, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1443 5.4 - Medium - July 14, 2020

A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages

CVE-2020-1444 4.3 - Medium - July 14, 2020

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server

CVE-2020-1178 8.8 - High - June 09, 2020

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1148 5.4 - Medium - June 09, 2020

An open redirect vulnerability exists in Microsoft SharePoint

CVE-2020-1323 6.1 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1298 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1318 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1320 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1297 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1177 5.4 - Medium - June 09, 2020

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server

CVE-2020-1183 5.4 - Medium - June 09, 2020

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls

CVE-2020-1181 8.8 - High - June 09, 2020

An elevation of privilege vulnerability exists in Microsoft SharePoint

CVE-2020-1295 8.8 - High - June 09, 2020