SE
Product
Sharepoint Enterprise Server
On CISA KEVExploited in the wildRansomware-linked
256
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 5High 128Medium 122Low 1
Watch
Add Sharepoint Enterprise Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0668 | 8.8 | Mar 5 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka… Affected: 2013; 2016 |
| CVE-2019-0594 | 8.8 | Mar 5 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2016 |
| CVE-2018-8635 | 8.8 | Dec 12 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint… Affected: 2013; 2016 |
| CVE-2018-8300 | 8.8 | Jul 11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka "Microsoft SharePoint Remote… Affected: 2013; 2016 |
| CVE-2018-1028 | 8.8 | Apr 12 | A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Graphics Remote Code… Affected: 2013; 2016 |
| CVE-2018-0947 | 8.8 | Mar 14 | Microsoft SharePoint Foundation 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests… Affected: 2013; 2016 |
| CVE-2018-0944 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0923 | 8.8 | Mar 14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint… Affected: 2013; 2016 |
| CVE-2018-0921 | 8.8 | Mar 14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint… Affected: 2016 |
| CVE-2018-0917 | 8.8 | Mar 14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint… Affected: 2016 |
| CVE-2018-0916 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0915 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0914 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0913 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0912 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0911 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0910 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0909 | 8.8 | Mar 14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are… Affected: 2016 |
| CVE-2018-0790 | 8.8 | Jan 10 | Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web… Affected: 2013; 2016 |
| CVE-2018-0789 | 8.8 | Jan 10 | Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web… Affected: 2013; 2016 |
| CVE-2017-11936 | 8.8 | Dec 12 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of… Affected: 2016 |
| CVE-2017-11876 | 8.8 | Nov 15 | Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the… Affected: 2016 |
| CVE-2017-8512 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2013; 2016 |
| CVE-2020-16946 | 8.7 | Oct 16 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
| CVE-2020-16945 | 8.7 | Oct 16 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
| CVE-2020-16944 | 8.7 | Oct 16 | <p>This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.</p> <p>An authenticated attacker… Affected: 2016 |
| CVE-2025-47994 | 8.6 | Jul 8 | Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally Affected: 2016 |
| CVE-2020-16952 | 8.6 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2016 |
| CVE-2020-16951 | 8.6 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2016 |
| CVE-2020-1460 | 8.6 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls Affected: 2013; 2016 |
| CVE-2020-1453 | 8.6 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2013; 2016 |
| CVE-2020-1452 | 8.6 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2013; 2016 |
| CVE-2020-1200 | 8.6 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2016 |
| CVE-2020-1576 | 8.5 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2013; 2016 |
| CVE-2025-53733 | 8.4 | Aug 12 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2021-41344 | 8.1 | Oct 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2021-40487 | 8.1 | Oct 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2018-8284 | 8.1 | Jul 11 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This… Affected: 2013; 2016 |
| CVE-2022-21987 | 8.0 | Feb 9 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2021-1726 | 8.0 | Feb 25 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2021-1719 | 8.0 | Jan 12 | Microsoft SharePoint Elevation of Privilege Vulnerability Affected: 2016 |
| CVE-2021-1712 | 8.0 | Jan 12 | Microsoft SharePoint Elevation of Privilege Vulnerability Affected: 2016 |
| CVE-2020-17016 | 8.0 | Nov 11 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2025-47169 | 7.8 | Jun 10 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2025-47168 | 7.8 | Jun 10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2025-29820 | 7.8 | Apr 8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2025-27747 | 7.8 | Apr 8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2022-41061 | 7.8 | Nov 9 | Microsoft Word Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2022-21842 | 7.8 | Jan 11 | Microsoft Word Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2021-40442 | 7.8 | Nov 10 | Microsoft Excel Remote Code Execution Vulnerability Affected: 2013 |