SS
Product
SQL Server
On CISA KEVExploited in the wildRansomware-linked
108
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 31Medium 4Low 0
Watch
Add SQL Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-0618 RansomwareIn wildKEV | 8.8 | Feb 11 | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Affected: 2012; 2014; 2016 |
| CVE-2019-1068 In wildKEV | 8.8 | Jul 15 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2014; 2014 |
| CVE-2012-1856 In wildKEV | 8.8 | Aug 15 | Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability Affected: 2000; 2000; 2005; 2005; 2008; 2008; +2 more |
| CVE-2018-8273 | 9.8 | Aug 15 | A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system, aka "Microsoft SQL Server Remote Code Execution… Affected: 2016; 2016; 2017 |
| CVE-2023-38169 | 8.8 | Aug 8 | Microsoft SQL OLE DB Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-21713 | 8.8 | Feb 14 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2012; 2014; 2016; 2017; 2019; 2022 |
| CVE-2023-21705 | 8.8 | Feb 14 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2012; 2014; 2016; 2017; 2019; 2022 |
| CVE-2021-1636 | 8.8 | Jan 12 | Microsoft SQL Elevation of Privilege Vulnerability Affected: 2012; 2014; 2016; 2017; 2019 |
| CVE-2016-7254 | 8.8 | Nov 10 | Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown… Affected: 2012; 2012 |
| CVE-2016-7253 | 8.8 | Nov 10 | The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain… Affected: 2012; 2012; 2014; 2014 |
| CVE-2016-7250 | 8.8 | Nov 10 | Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via… Affected: 2014; 2014; 2016 |
| CVE-2016-7249 | 8.8 | Nov 10 | Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL… Affected: 2016 |
| CVE-2024-0056 | 8.7 | Jan 9 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Affected: 2022; 2022 |
| CVE-2009-2502 | 8.1 | Oct 14 | Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2023-36785 | 7.8 | Oct 10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-36730 | 7.8 | Oct 10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-36420 | 7.8 | Oct 10 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-36417 | 7.8 | Oct 10 | Microsoft SQL OLE DB Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-32027 | 7.8 | Jun 16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-32026 | 7.8 | Jun 16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-32025 | 7.8 | Jun 16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-29356 | 7.8 | Jun 16 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-29349 | 7.8 | Jun 16 | Microsoft ODBC and OLE DB Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-32028 | 7.8 | Jun 16 | Microsoft SQL OLE DB Remote Code Execution Vulnerability Affected: 2019; 2022 |
| CVE-2023-21718 | 7.8 | Feb 14 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2008; 2008_r2; 2012; 2014; 2016; 2017; +2 more |
| CVE-2023-21704 | 7.8 | Feb 14 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected: 2014; 2016; 2017; 2019; 2022 |
| CVE-2023-21528 | 7.8 | Feb 14 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2008; 2012; 2014; 2016; 2017; 2019; +1 more |
| CVE-2022-23276 | 7.8 | Feb 9 | SQL Server for Linux Containers Elevation of Privilege Vulnerability Affected: 2019 |
| CVE-2022-29143 | 7.5 | Jun 15 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2014; 2016; 2016; 2017; 2019 |
| CVE-2017-8516 | 7.5 | Aug 8 | Microsoft SQL Server Analysis Services in Microsoft SQL Server 2012, Microsoft SQL Server 2014, and Microsoft SQL Server 2016 allows an information disclosure vulnerability when… Affected: 2012; 2014; 2014; 2016; 2016 |
| CVE-2002-1872 | 7.5 | Dec 31 | Microsoft SQL Server 6.0 through 2000, with SQL Authentication enabled, uses weak password encryption (XOR), which allows remote attackers to sniff and decrypt the password Affected: 6.0; 6.5; 7.0; 7.0; 7.0; 7.0; +4 more |
| CVE-2023-23384 | 7.3 | Apr 11 | Microsoft SQL Server Remote Code Execution Vulnerability Affected: 2008; 2008; 2012; 2014; 2016; 2017; +2 more |
| CVE-2019-0819 | 6.5 | May 16 | An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka 'Microsoft SQL Server Analysis… Affected: 2017 |
| CVE-2016-7252 | 6.5 | Nov 10 | Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services… Affected: 2016 |
| CVE-2016-7251 | 6.1 | Nov 10 | Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter,… Affected: 2016 |
| CVE-2023-36728 | 5.5 | Oct 10 | Microsoft SQL Server Denial of Service Vulnerability Affected: 2014; 2016; 2017; 2019; 2022 |
| CVE-2015-1763 | – | Jul 14 | Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual… Affected: 2008; 2008; 2008; 2008; 2012; 2012; +1 more |
| CVE-2015-1762 | – | Jul 14 | Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory… Affected: 2008; 2008; 2008; 2008; 2012; 2012; +1 more |
| CVE-2015-1761 | – | Jul 14 | Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified pointers, which allows remote… Affected: 2008; 2008; 2008; 2008; 2012; 2012; +1 more |
| CVE-2014-4061 | – | Aug 12 | Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commands, which allows remote authenticated… Affected: 2008; 2008; 2008; 2008; 2008; 2008; +2 more |
| CVE-2014-1820 | – | Aug 12 | Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary… Affected: 2012; 2014 |
| CVE-2012-2552 | – | Oct 9 | Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2… Affected: 2005; 2005; 2005; 2005; 2008; 2008; +9 more |
| CVE-2011-1280 | – | Jun 16 | The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio… Affected: 2005; 2005; 2005; 2005; 2005; 2005; +11 more |
| CVE-2009-3126 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2009-2528 | – | Oct 14 | GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2009-2504 | – | Oct 14 | Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2009-2503 | – | Oct 14 | GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2009-2501 | – | Oct 14 | Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2009-2500 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: 2005; 2005; 2005; 2005; 2005; 2005 |
| CVE-2008-5416 | – | Dec 10 | Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and… Affected: 2000; 2005 |