Microsoft Sharepoint Enterprise Server vulnerabilities

CVE-2019-1257 [HIGH] CWE-20 CVE-2019-1257: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296.

CVE-2019-1261 [HIGH] CVE-2019-1261: A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to autho A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique

CVE-2019-1295 [HIGH] CVE-2019-1295: A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly prot A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1296.

CVE-2019-1296 [HIGH] CVE-2019-1296: A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly prot A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1295.

CVE-2019-1260 [MEDIUM] CVE-2019-1260: An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint El An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.

CVE-2019-1201 [HIGH] CVE-2019-1201: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. The file could then take actions on behalf of the logged-on user with the same perm

CVE-2019-1203 [MEDIUM] CWE-79 CVE-2019-1203: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2019-1202 [MEDIUM] CWE-200 CVE-2019-1202: An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objec An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited the vulnerability could hijack the session of another user. To exploit this vulnerability, the attacker could run a specially crafted application. The security update corrects how SharePoint handl

CVE-2019-1006 [HIGH] CWE-295 CVE-2019-1006: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

CVE-2019-1134 [MEDIUM] CWE-79 CVE-2019-1134: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

CVE-2019-1034 [HIGH] CVE-2019-1034: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with

CVE-2019-1032 [MEDIUM] CWE-79 CVE-2019-1032: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2019-1033 [MEDIUM] CWE-79 CVE-2019-1033: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2019-1036 [MEDIUM] CWE-79 CVE-2019-1036: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2019-1031 [MEDIUM] CWE-79 CVE-2019-1031: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2019-0952 [HIGH] CVE-2019-0952: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properl A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

CVE-2019-0957 [HIGH] CWE-20 CVE-2019-0957: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sa An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0958.

CVE-2019-0956 [MEDIUM] CWE-116 CVE-2019-0956: An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sa An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Server Information Disclosure Vulnerability'.

CVE-2019-0830 [MEDIUM] CWE-79 CVE-2019-0830: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831.

CVE-2019-0831 [MEDIUM] CVE-2019-0831: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.