Microsoft Sharepoint Server vulnerabilities

CVE-2020-0977 [MEDIUM] CVE-2020-0977: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specia A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0975, CVE-2020-0976.

CVE-2018-8572 [MEDIUM] CVE-2018-8572: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sa An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint. This CVE ID is unique from CVE-2018-8568.

CVE-2026-55142 [MEDIUM] CWE-197 CVE-2026-55142: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose inform Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2026-44821 [MEDIUM] CWE-125 CVE-2026-44821: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information local Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVE-2026-62829 [MEDIUM] CWE-79 CVE-2026-62829: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-69417 [MEDIUM] CWE-79 CVE-2026-69417: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-69402 [MEDIUM] CWE-79 CVE-2026-69402: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-69690 [MEDIUM] CWE-79 CVE-2026-69690: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2013-1290 [LOW] CWE-264 CVE-2013-1290: Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not prop Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vuln

CVE-2020-1583 [MEDIUM] CVE-2020-1583: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1502 [MEDIUM] CVE-2020-1502: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2020-1503 [MEDIUM] CVE-2020-1503: An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker mus

CVE-2026-62917 [MEDIUM] CWE-20 CVE-2026-62917: Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform sp Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2020-1323 [MEDIUM] CWE-601 CVE-2020-1323: An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link, aka 'SharePoint Open Redirect Vulnerability'.

CVE-2026-105720 [MEDIUM] CWE-863 CVE-2026-105720: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate priv Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2018-0864 [MEDIUM] CWE-79 CVE-2018-0864: SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability".

CVE-2019-1442 [MEDIUM] CWE-346 CVE-2019-1442: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attac A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

CVE-2017-8629 [MEDIUM] CWE-79 CVE-2017-8629: Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability".

CVE-2014-1754 [MEDIUM] CWE-79 CVE-2014-1754: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoin Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

CVE-2020-1456 [MEDIUM] CVE-2020-1456: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1451.