SS
Product
SQL Server
On CISA KEVExploited in the wildRansomware-linked
108
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 31Medium 4Low 0
Watch
Add SQL Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-4110 | – | Sep 16 | Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\Binn\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a… Affected: 2000 |
| CVE-2008-3015 | – | Sep 11 | Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003,… Affected: 2005 |
| CVE-2008-3014 | – | Sep 11 | Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3,… Affected: 2005 |
| CVE-2008-3013 | – | Sep 11 | gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3,… Affected: 2005 |
| CVE-2008-3012 | – | Sep 11 | gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3,… Affected: 2005 |
| CVE-2007-5348 | – | Sep 11 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and… Affected: 2005 |
| CVE-2008-0106 | – | Jul 8 | Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert… Affected: 7.0; 2000; 2005 |
| CVE-2008-0085 | – | Jul 8 | SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine… Affected: 7.0; 2000; 2000; 2005; 2005; 2005; +5 more |
| CVE-2008-0086 | – | Jul 8 | Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to… Affected: 7.0; 2000; 2005 |
| CVE-2008-0107 | – | Jul 8 | Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE);… Affected: 7.0; 2000; 2000; 2005; 2005; 2005; +5 more |
| CVE-2007-4814 | – | Sep 11 | Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise Manager 8.05.2004… Affected: 2005 |
| CVE-2004-1560 | – | Dec 31 | Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly triggering a buffer overflow Affected: 7.0; 7.0; 7.0; 7.0; 7.0 |
| CVE-2003-0232 | – | Aug 27 | Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +5 more |
| CVE-2003-0231 | – | Aug 27 | Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +5 more |
| CVE-2003-0230 | – | Aug 27 | Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking"… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +5 more |
| CVE-2002-1981 | – | Dec 31 | Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows… Affected: 2000; 2000; 2000 |
| CVE-2002-1145 | – | Oct 28 | The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +2 more |
| CVE-2002-1138 | – | Oct 11 | Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +2 more |
| CVE-2002-1137 | – | Oct 11 | Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +2 more |
| CVE-2002-1123 | – | Sep 24 | Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long… Affected: 2000; 2000; 2000 |
| CVE-2002-0982 | – | Sep 24 | Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MScopyscript stored procedure Affected: 2000 |
| CVE-2002-0859 | – | Sep 5 | Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code Affected: 2000; 2000; 2000 |
| CVE-2002-0721 | – | Sep 5 | Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users,… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 2000; +2 more |
| CVE-2002-0729 | – | Aug 12 | Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator Affected: 2000 |
| CVE-2002-0650 | – | Aug 12 | The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a "ping" style packet to the Resolution… Affected: 2000; 2000; 2000 |
| CVE-2002-0649 | – | Aug 12 | Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or… Affected: 2000; 2000; 2000 |
| CVE-2002-0645 | – | Aug 12 | SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands Affected: 2000 |
| CVE-2002-0644 | – | Aug 12 | Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and… Affected: 2000 |
| CVE-2002-0643 | – | Jul 23 | The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after… Affected: 7.0; 7.0; 7.0; 7.0; 2000; 2000; +1 more |
| CVE-2002-0642 | – | Jul 23 | The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, has insecure… Affected: 2000 |
| CVE-2002-0641 | – | Jul 23 | Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration… Affected: 2000 |
| CVE-2002-0624 | – | Jul 23 | Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows remote attackers to gain… Affected: 2000 |
| CVE-2002-0187 | – | Jul 3 | Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL… Affected: 2000; 2000; 2000 |
| CVE-2002-0186 | – | Jul 3 | Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter,… Affected: 2000; 2000; 2000 |
| CVE-2002-0224 | – | May 16 | The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to… Affected: 6.5; 7.0; 7.0; 7.0; 7.0; 2000; +2 more |
| CVE-2002-0154 | – | May 16 | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database… Affected: 7.0; 7.0; 7.0; 7.0; 2000; 2000; +1 more |
| CVE-2002-0057 | – | Mar 8 | XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by… Affected: 2000; 2000; 2000 |
| CVE-2002-0056 | – | Mar 8 | Buffer overflow in SQL Server 7.0 and 2000 allows remote attackers to execute arbitrary code via a long OLE DB provider name to (1) OpenDataSource or (2) OpenRowset in an ad hoc… Affected: 7.0; 2000 |
| CVE-2001-0879 | – | Dec 20 | Format string vulnerability in the C runtime functions in SQL Server 7.0 and 2000 allows attackers to cause a denial of service Affected: 7.0; 2000 |
| CVE-2001-0542 | – | Dec 20 | Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage,… Affected: 7.0; 2000 |
| CVE-2001-0509 | – | Sep 20 | Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote… Affected: 7.0; 2000 |
| CVE-2001-0344 | – | Jul 21 | An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa… Affected: 7.0; 2000 |
| CVE-2000-1088 | – | Jan 9 | The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo… Affected: 7.0; 2000 |
| CVE-2000-1087 | – | Jan 9 | The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the… Affected: 7.0; 2000 |
| CVE-2000-1086 | – | Jan 9 | The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the… Affected: 7.0; 2000 |
| CVE-2000-1085 | – | Jan 9 | The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo… Affected: 7.0; 2000 |
| CVE-2000-1084 | – | Jan 9 | The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo… Affected: 7.0; 2000 |
| CVE-2000-1083 | – | Jan 9 | The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function… Affected: 7.0; 2000 |
| CVE-2000-1082 | – | Jan 9 | The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo… Affected: 7.0; 2000 |
| CVE-2000-1081 | – | Jan 9 | The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo… Affected: 7.0; 2000 |