Filtered by vendor Microsoft Subscriptions
Filtered by product Sharepoint Server Subscriptions
Total 432 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2007-2581 1 Microsoft 3 Sharepoint Server, Sharepoint Services, Windows 2003 2025-04-09 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.
CVE-2009-3830 1 Microsoft 1 Sharepoint Server 2025-04-09 N/A
The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers to read ASP.NET source code via pathnames in the SourceUrl and Source parameters to _layouts/download.aspx.
CVE-2008-3006 1 Microsoft 4 Office, Office Compatibility Pack, Office Excel Viewer and 1 more 2025-04-09 N/A
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel Viewer; Office Compatibility Pack 2007 Gold and SP1; Office SharePoint Server 2007 Gold and SP1; and Office 2004 and 2008 for Mac do not properly parse Country record values when loading Excel files, which allows remote attackers to execute arbitrary code via a crafted Excel file, aka the "Excel Record Parsing Vulnerability."
CVE-2008-1888 1 Microsoft 1 Sharepoint Server 2025-04-09 N/A
Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
CVE-2008-4019 1 Microsoft 6 Excel, Excel Viewer, Office and 3 more 2025-04-09 N/A
Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell, aka "Formula Parsing Vulnerability."
CVE-2008-5026 1 Microsoft 1 Sharepoint Server 2025-04-09 N/A
Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
CVE-2008-4033 1 Microsoft 13 Expression Web, Groove, Office and 10 more 2025-04-09 N/A
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
CVE-2014-1761 1 Microsoft 7 Office, Office Compatibility Pack, Office Web Apps and 4 more 2025-04-07 7.8 High
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
CVE-2012-2539 1 Microsoft 5 Office Compatibility Pack, Office Web Apps, Office Word Viewer and 2 more 2025-04-07 7.8 High
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
CVE-2017-11826 1 Microsoft 7 Office Compatibility Pack, Office Online Server, Office Web Apps Server and 4 more 2025-04-07 7.8 High
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.
CVE-2015-1641 1 Microsoft 6 Office, Office Compatibility Pack, Office Web Apps and 3 more 2025-04-04 7.8 High
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2019-0604 1 Microsoft 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server 2025-04-04 9.8 Critical
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
CVE-2025-21393 1 Microsoft 1 Sharepoint Server 2025-04-02 6.3 Medium
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2025-21348 1 Microsoft 1 Sharepoint Server 2025-04-02 7.2 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21344 1 Microsoft 1 Sharepoint Server 2025-04-02 7.8 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-33880 2 Microsoft, Virtosoftware 2 Sharepoint Server, Sharepoint Bulk File Download 2025-03-19 5.3 Medium
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.
CVE-2012-1889 1 Microsoft 15 Expression Web, Groove, Groove Server and 12 more 2025-03-14 8.8 High
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2023-24955 1 Microsoft 2 Sharepoint Enterprise Server, Sharepoint Server 2025-03-13 7.2 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21400 1 Microsoft 1 Sharepoint Server 2025-03-12 8 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-49065 1 Microsoft 5 365 Apps, Office, Office Long Term Servicing Channel and 2 more 2025-03-11 5.5 Medium
Microsoft Office Remote Code Execution Vulnerability