The Microsoft SharePoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Microsoft Office does not validate URLs. An attacker     could send a victim a specially crafted file, which     could trick the victim into entering credentials. An     attacker who successfully exploited this vulnerability     could perform a phishing attack. The update addresses     the vulnerability by ensuring Microsoft Office properly     validates URLs. (CVE-2019-1442)

  - An information disclosure vulnerability exists in     Microsoft SharePoint when an attacker uploads a     specially crafted file to the SharePoint Server. An     authenticated attacker who successfully exploited this     vulnerability could potentially leverage SharePoint     functionality to obtain SMB hashes. The security update     addresses the vulnerability by correcting how SharePoint     checks file content. (CVE-2019-1443)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2019-1446)

  - An information disclosure vulnerability exists in     Microsoft SharePoint when an attacker sends a specially     crafted API request to the SharePoint Server. An     authenticated attacker who successfully exploited this     vulnerability could potentially read arbitrary files     on the server. The security update     addresses the vulnerability by changing how     affected APIs process requests. (CVE-2019-1491)

Detections

Analytics

Security Updates for Microsoft SharePoint Server (November 2019)

high Nessus Plugin ID 130914

Version 1.12

Version 1.11

Version 1.12 Jun 6, 2024, 5:45 PM Plugin metadata (Add version information to CPEs) Plugin Feed: 202406061745
Version 1.11 Apr 14, 2023, 8:00 PM Logic Changes (Updated from old coding standard to new) Plugin Feed: 202304142000