Microsoft Project Server vulnerabilities

24 CVEs affecting Microsoft Project Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-0954, published 2020-04-15.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-8284, published 2018-07-11. High severity, CVSS 8.1. EPSS: 46% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET…
• CVE-2009-0102, published 2009-12-09. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a…
• CVE-2006-6617, published 2006-12-18. Medium severity, CVSS 6.5. EPSS: 20.4% chance of exploitation in the next 30 days. projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request,…
• CVE-2015-2503, published 2015-11-11. High severity, CVSS 9.3. EPSS: 16.5% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese)…
• CVE-2017-0281, published 2017-05-12. High severity, CVSS 7.8. EPSS: 15.8% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise…
• CVE-2014-0251, published 2014-05-14. High severity, CVSS 9.0. EPSS: 14.2% chance of exploitation in the next 30 days. Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010…
• CVE-2015-1640, published 2015-04-14. Medium severity, CVSS 4.3. EPSS: 8.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft…
• CVE-2018-0944, published 2018-03-14. High severity, CVSS 8.8. EPSS: 4.5% chance of exploitation in the next 30 days. Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka…
• CVE-2018-0916, published 2018-03-14. High severity, CVSS 8.8. EPSS: 4.5% chance of exploitation in the next 30 days. Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft…
• CVE-2018-0915, published 2018-03-14. High severity, CVSS 8.8. EPSS: 4.5% chance of exploitation in the next 30 days. Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft…

Latest

• CVE-2020-0954, published 2020-04-15. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office…
• CVE-2019-1036, published 2019-06-12. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated…
• CVE-2019-1033, published 2019-06-12. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated…
• CVE-2019-1031, published 2019-06-12. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated…
• CVE-2018-8254, published 2018-06-14. Medium severity, CVSS 5.4. EPSS: 2.8% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint…
• CVE-2018-8156, published 2018-05-09. Medium severity, CVSS 5.4. EPSS: 2.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint…