Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

256 records in Sharepoint Enterprise Server · all components

Priority CRITICAL 100KEV

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99913 Published 2019-03-06 No fix listed CWE-20
Priority CRITICAL 93KEV

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Vi…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.95804 Published 2020-07-14 Fixed in 2.1.20, 3.1.6
TI-2017-08774 CVE-2017-11826 · GHSA-4qcg-gx82-4h36

Memory corruption in Microsoft Office

Priority CRITICAL 93KEV

Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.82217 Published 2017-10-13 No fix listed CWE-119
Priority CRITICAL 90

Microsoft Word Remote Code Execution Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.848 Published 2023-02-14 Fixed in https://aka.ms/OfficeSecurityReleases, 16.70.23021201 +4 CWE-190
Priority CRITICAL 86KEV

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.99057 Published 2025-07-08 Fixed in 16.0.5508.1000, 16.0.10417.20027 +1 CWE-287
Priority HIGH 75

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.71095 Published 2020-10-16 Fixed in publication CWE-346
Priority HIGH 75

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.69303 Published 2020-06-09 No fix listed
Priority HIGH 65

Microsoft SharePoint Server Spoofing Vulnerability

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.67452 Published 2023-05-09 Fixed in 16.0.5395.1000, 16.0.10398.20000 +1 CWE-20
TI-2018-05989 CVE-2018-8284 · GHSA-c5vc-j56m-8jj4

Code injection in Microsoft .NET Framework

Priority HIGH 65

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Micros…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.45991 Published 2018-07-11 No fix listed CWE-94
Priority MEDIUM 64

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.35535 Published 2020-04-15 No fix listed CWE-434
Priority MEDIUM 60

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22566 Published 2025-06-10 Fixed in 16.0.5504.1001, 16.0.10417.20018 +1 CWE-502
Priority MEDIUM 60

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.21819 Published 2025-06-10 Fixed in 16.0.5504.1001, 16.0.10417.20018 +1 CWE-502
Priority MEDIUM 60

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04017 Published 2020-05-21 Fixed in publication CWE-79
Priority MEDIUM 58

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02229 Published 2020-07-14 No fix listed CWE-79
Priority MEDIUM 57

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution V…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.20265 Published 2020-07-14 No fix listed CWE-502
TI-2018-00951 CVE-2018-1028 · GHSA-87hq-2c3x-p62g

Code injection in Microsoft Word

Priority MEDIUM 56

A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code Execution Vulnerability." This affects Word,…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.18919 Published 2018-04-12 No fix listed CWE-94
TI-2018-00738 CVE-2018-0797 · GHSA-f2vj-ccgm-xw84

Out-of-bounds write in Microsoft Office

Priority MEDIUM 55

Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word Memory Corruption Vulnerability".

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.24662 Published 2018-01-10 No fix listed CWE-787
Load more
Open these records in search →