WX
Product
Windows XP
On CISA KEVExploited in the wild
738
CVEs
13
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 69Medium 5Low 0
Watch
Add Windows XP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-4250 In wildKEV | 9.8 | Oct 23 | Microsoft Windows Buffer Overflow Vulnerability Affected: All versions, or not specified |
| CVE-2013-3918 In wildKEV | 8.8 | Nov 12 | Microsoft Windows Out-of-Bounds Write Vulnerability Affected: All versions, or not specified |
| CVE-2011-3402 In wildKEV | 8.8 | Nov 4 | Microsoft Windows Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2008-0015 In wildKEV | 8.8 | Jul 7 | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2009-1537 In wildKEV | 8.8 | May 29 | Microsoft DirectX NULL Byte Overwrite Vulnerability Affected: All versions, or not specified |
| CVE-2013-5065 In wildKEV | 7.8 | Nov 27 | Microsoft Windows Kernel Privilege Escalation Vulnerability Affected: All versions, or not specified |
| CVE-2013-3660 In wildKEV | 7.8 | May 24 | Microsoft Win32k Privilege Escalation Vulnerability Affected: All versions, or not specified |
| CVE-2012-0151 In wildKEV | 7.8 | Apr 10 | Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2011-2005 In wildKEV | 7.8 | Oct 12 | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability Affected: All versions, or not specified |
| CVE-2010-4398 In wildKEV | 7.8 | Dec 3 | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability Affected: All versions, or not specified |
| CVE-2010-2568 In wildKEV | 7.8 | Jul 22 | Microsoft Windows Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2010-0232 In wildKEV | 7.8 | Jan 21 | Microsoft Windows Kernel Exception Handler Vulnerability Affected: All versions, or not specified |
| CVE-2009-1123 In wildKEV | 7.8 | Jun 10 | Microsoft Windows Improper Input Validation Vulnerability Affected: All versions, or not specified |
| CVE-2011-0657 | 9.8 | Apr 13 | DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7… Affected: All versions, or not specified |
| CVE-2009-2494 | 9.8 | Aug 12 | The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2008-4835 | 9.8 | Jan 14 | SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2008-3465 | 9.8 | Dec 10 | Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent… Affected: All versions, or not specified |
| CVE-2002-0391 | 9.8 | Aug 12 | Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to… Affected: All versions, or not specified |
| CVE-2000-1218 | 9.8 | Apr 14 | The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS… Affected: All versions, or not specified |
| CVE-2013-0006 | 8.8 | Jan 9 | Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka… Affected: All versions, or not specified |
| CVE-2012-0175 | 8.8 | Jul 10 | The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote… Affected: All versions, or not specified |
| CVE-2011-3406 | 8.8 | Dec 14 | Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3,… Affected: All versions, or not specified |
| CVE-2010-0820 | 8.8 | Sep 15 | Heap-based buffer overflow in the Local Security Authority Subsystem Service (LSASS), as used in Active Directory in Microsoft Windows Server 2003 SP2 and Windows Server 2008… Affected: All versions, or not specified |
| CVE-2009-1547 | 8.8 | Oct 14 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers… Affected: All versions, or not specified |
| CVE-2009-1544 | 8.8 | Aug 12 | Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3… Affected: All versions, or not specified |
| CVE-2009-2493 | 8.8 | Jul 29 | The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and… Affected: All versions, or not specified |
| CVE-2009-0231 | 8.8 | Jul 15 | The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows… Affected: All versions, or not specified |
| CVE-2013-1340 | 8.4 | Jul 10 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows… Affected: All versions, or not specified |
| CVE-2012-1867 | 8.4 | Jun 12 | Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1,… Affected: All versions, or not specified |
| CVE-2012-0157 | 8.4 | Mar 13 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold… Affected: All versions, or not specified |
| CVE-2011-1881 | 8.4 | Jul 13 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and… Affected: All versions, or not specified |
| CVE-2011-1282 | 8.4 | Jul 13 | The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server… Affected: All versions, or not specified |
| CVE-2011-0671 | 8.4 | Apr 13 | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2011-1231 | 8.4 | Apr 13 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and… Affected: All versions, or not specified |
| CVE-2010-3941 | 8.4 | Dec 16 | Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2010-1896 | 8.4 | Aug 11 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 do not… Affected: All versions, or not specified |
| CVE-2008-4036 | 8.4 | Oct 15 | Integer overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain privileges via a… Affected: All versions, or not specified |
| CVE-2004-2339 | 8.4 | Dec 31 | Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the… Affected: All versions, or not specified |
| CVE-2017-0176 | 8.1 | Jun 22 | A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary… Affected: All versions, or not specified |
| CVE-2013-3894 | 8.1 | Oct 9 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… Affected: All versions, or not specified |
| CVE-2013-0810 | 8.1 | Sep 11 | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted… Affected: All versions, or not specified |
| CVE-2012-0003 | 8.1 | Jan 10 | Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008… Affected: 2005 |
| CVE-2010-0492 | 8.1 | Mar 31 | Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the… Affected: All versions, or not specified |
| CVE-2009-3671 | 8.1 | Dec 9 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly… Affected: All versions, or not specified |
| CVE-2009-2529 | 8.1 | Oct 14 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2009-2502 | 8.1 | Oct 14 | Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002… Affected: All versions, or not specified |
| CVE-2008-1083 | 8.1 | Apr 8 | Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote… Affected: All versions, or not specified |
| CVE-2017-8487 | 7.8 | Jun 15 | Windows OLE in Windows XP and Windows Server 2003 allows an attacker to execute code when a victim opens a specially crafted file or program aka "Windows olecnv32.dll Remote Code… Affected: All versions, or not specified |
| CVE-2017-8461 | 7.8 | Jun 15 | Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote… Affected: All versions, or not specified |
| CVE-2013-1342 | 7.8 | Sep 11 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)