Microsoft SQL Server vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
107 matching records
- Medium6.8Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commands, which allows remote auth…Check this weekEPSS 26.50%Aug 12, 2014
- Medium4.3Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject…Check this weekEPSS 14.72%Aug 12, 2014
- Medium4.3Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3…Check this weekEPSS 16.30%Oct 9, 2012
- Critical9.0Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and…Check this weekEPSS 87.04%Dec 10, 2008
- High7.6Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\Binn\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to…Check this weekEPSS 18.41%Sep 16, 2008
- High7.5Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to corrupt data via unspecified vectors.Check if you run itEPSS 1.93%Sep 26, 2007
- High7.5Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise Manager…Check this weekEPSS 45.71%Sep 11, 2007
- Medium5.0Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly triggering a buffer overflow.Check this weekEPSS 25.64%Dec 31, 2004
- High7.2Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow.Check if you run itEPSS 4.13%Aug 27, 2003
- Medium5.0Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe.Check this weekEPSS 36.18%Aug 27, 2003
- Medium5.0Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures,…Check if you run itEPSS 4.58%Dec 31, 2002
- High7.5Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password.Check if you run itEPSS 6.98%Dec 31, 2002
- High7.5Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure.Check if you run itEPSS 7.82%Sep 24, 2002
- High7.5Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.Check this weekEPSS 26.17%Sep 5, 2002
- Medium5.0Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator.Check this weekEPSS 10.66%Aug 12, 2002
- Medium5.0The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Re…Check this weekEPSS 18.29%Aug 12, 2002
- High7.5SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands.Check if you run itEPSS 3.84%Aug 12, 2002
- High7.5Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part o…Check this weekEPSS 13.89%Jul 3, 2002
- High7.5Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type…Check this weekEPSS 55.45%Jul 3, 2002
- High7.5Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via…Check this weekEPSS 24.86%May 16, 2002
- High7.5Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in…Check this weekEPSS 24.86%Mar 8, 2002
- Medium5.0Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service.Check if you run itEPSS 7.36%Dec 20, 2001
- High7.5CVE-2001-0542 is listed by inventory_critical.Check this weekEPSS 13.62%Dec 20, 2001
- High7.2An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa…Check if you run itEPSS 1.92%Jul 21, 2001
- Medium4.6Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a…Check if you run itEPSS 1.38%Jul 11, 2000