Microsoft SharePoint Foundation vulnerabilities

226 CVEs affecting Microsoft SharePoint Foundation, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28288, published 2023-04-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability, published 2019-03-05. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution…
• CVE-2023-21716, published 2023-02-14. Critical severity, CVSS 9.8. EPSS: 84.8% chance of exploitation in the next 30 days. Microsoft Word Remote Code Execution Vulnerability
• CVE-2022-44690, published 2022-12-13. High severity, CVSS 8.8. EPSS: 82.1% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2022-38053, published 2022-10-11. High severity, CVSS 8.8. EPSS: 76.4% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2013-0081, published 2013-09-11. Medium severity, CVSS 5.0. EPSS: 76.2% chance of exploitation in the next 30 days. Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of…
• CVE-2020-16952, published 2020-10-16. High severity, CVSS 8.6. EPSS: 71.1% chance of exploitation in the next 30 days. <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the…
• CVE-2020-1181, published 2020-06-09. High severity, CVSS 8.8. EPSS: 69.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code…
• CVE-2013-3180, published 2013-09-11. Medium severity, CVSS 4.3. EPSS: 65.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST…
• CVE-2023-21742, published 2023-01-10. High severity, CVSS 8.8. EPSS: 55.8% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2016-3357, published 2016-09-14. High severity, CVSS 7.8. EPSS: 54.8% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010…

Latest

• CVE-2023-28288, published 2023-04-11. High severity, CVSS 8.1. EPSS: 6.2% chance of exploitation in the next 30 days. Microsoft SharePoint Server Spoofing Vulnerability
• CVE-2023-23395, published 2023-03-14. Low severity, CVSS 3.1. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft SharePoint Server Spoofing Vulnerability
• CVE-2023-21717, published 2023-02-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Microsoft SharePoint Server Elevation of Privilege Vulnerability
• CVE-2023-21744, published 2023-01-10. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2022-44693, published 2022-12-13. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
• CVE-2022-41122, published 2022-11-09. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft SharePoint Server Spoofing Vulnerability
• CVE-2022-41062, published 2022-11-09. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability