CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-0789
https://notcve.org/view.php?id=CVE-2018-0789
Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0790. Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 y Microsoft SharePoint Server 2016 permiten una vulnerabilidad de elevación de privilegios debido a la forma en la que se gestionan las peticiones web. Esto también se conoce como "Microsoft SharePoint Elevation of Privilege Vulnerability". Este CVE es diferente de CVE-2018-0790. • http://www.securityfocus.com/bid/102394 http://www.securitytracker.com/id/1040150 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0789 •
CVSS: 9.3EPSS: 9%CPEs: 16EXPL: 0CVE-2018-0797
https://notcve.org/view.php?id=CVE-2018-0797
Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word Memory Corruption Vulnerability". Microsoft Office 2010, Microsoft Office 2013 y Microsoft Office 2016 permiten una vulnerabilidad de ejecución remota de código debido a la forma en la que se gestiona el contenido RTF. Esto también se conoce como "Microsoft Word Memory Corruption Vulnerability". • http://www.securityfocus.com/bid/102406 http://www.securitytracker.com/id/1040153 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0797 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11876
https://notcve.org/view.php?id=CVE-2017-11876
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability". Microsoft Project Server y Microsoft SharePoint Enterprise Server 2016 permiten que un atacante emplee Cross-Site Forgery para leer contenido para el que no tiene permiso, emplee la identidad de la víctima para realizar acciones en la aplicación web en su nombre (como cambiar permisos y eliminar contenido) e inyecte contenido malicioso en el navegador de la víctima. Esto también se conoce como "Microsoft Project Server Elevation of Privilege Vulnerability". • http://www.securityfocus.com/bid/101754 http://www.securitytracker.com/id/1039788 http://www.securitytracker.com/id/1039789 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11876 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11775
https://notcve.org/view.php?id=CVE-2017-11775
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11777 and CVE-2017-11820. Microsoft SharePoint Enterprise Server 2013 SP1 y Microsoft SharePoint Enterprise Server 2016 permiten que un atacante explote una vulnerabilidad Cross-Site Scripting (XSS) enviando una petición especialmente manipulada a un servidor SharePoint afectado, Esto ocurre debido a la manera en la que el servidor SharePoint sanitiza las peticiones web. Esto también se conoce como "Microsoft Office SharePoint XSS Vulnerability". El ID de este CVE es diferente de CVE-2017-11777 y CVE-2017-11820. • http://www.securityfocus.com/bid/101105 http://www.securitytracker.com/id/1039540 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11775 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-11777
https://notcve.org/view.php?id=CVE-2017-11777
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820. Microsoft SharePoint Enterprise Server 2013 SP1 y Microsoft SharePoint Enterprise Server 2016 permiten que un atacante explote una vulnerabilidad Cross-Site Scripting (XSS) enviando una petición especialmente manipulada a un servidor SharePoint afectado, Esto ocurre debido a la manera en la que el servidor SharePoint sanitiza las peticiones web. Esto también se conoce como "Microsoft Office SharePoint XSS Vulnerability". El ID de este CVE es diferente de CVE-2017-11775 y CVE-2017-11820. • http://www.securityfocus.com/bid/101155 http://www.securitytracker.com/id/1039540 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11777 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •