WX
Product
Windows XP
On CISA KEVExploited in the wild
738
CVEs
13
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 69Medium 5Low 0
Watch
Add Windows XP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-3129 | 7.8 | Jul 10 | Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows… Affected: All versions, or not specified |
| CVE-2012-2897 | 7.8 | Sep 26 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows… Affected: All versions, or not specified |
| CVE-2012-0180 | 7.8 | May 9 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and… Affected: All versions, or not specified |
| CVE-2011-1874 | 7.8 | Jul 13 | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2011-1236 | 7.8 | Apr 13 | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2011-0676 | 7.8 | Apr 13 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and… Affected: All versions, or not specified |
| CVE-2011-0042 | 7.8 | Mar 9 | SBE.dll in the Stream Buffer Engine in Windows Media Player and Windows Media Center in Microsoft Windows XP SP2 and SP3, Windows XP Media Center Edition 2005 SP3, Windows Vista… Affected: All versions, or not specified |
| CVE-2010-1883 | 7.8 | Oct 13 | Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2,… Affected: All versions, or not specified |
| CVE-2010-0485 | 7.8 | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server… Affected: All versions, or not specified |
| CVE-2009-0082 | 7.8 | Mar 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate handles, which allows local users… Affected: All versions, or not specified |
| CVE-2008-0322 | 7.8 | May 13 | The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which allows local users… Affected: All versions, or not specified |
| CVE-2003-1048 | 7.8 | Jul 27 | Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF… Affected: All versions, or not specified |
| CVE-2012-5364 | 7.5 | Feb 20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing… Affected: All versions, or not specified |
| CVE-2012-5362 | 7.5 | Feb 20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different… Affected: All versions, or not specified |
| CVE-2019-1489 | 7.5 | Dec 10 | An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information… Affected: All versions, or not specified |
| CVE-2008-0087 | 7.5 | Apr 8 | The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses Affected: All versions, or not specified |
| CVE-2004-0119 | 7.5 | Jun 1 | The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from… Affected: All versions, or not specified |
| CVE-2013-1278 | 7.4 | Feb 13 | Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1,… Affected: All versions, or not specified |
| CVE-2011-0029 | 7.4 | Mar 9 | Untrusted search path vulnerability in the client in Microsoft Remote Desktop Connection 5.2, 6.0, 6.1, and 7.0 allows local users to gain privileges via a Trojan horse DLL in the… Affected: All versions, or not specified |
| CVE-2010-3957 | 7.3 | Dec 16 | Double free vulnerability in the OpenType Font (OTF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2,… Affected: All versions, or not specified |
| CVE-2011-1985 | 7.1 | Oct 12 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold… Affected: All versions, or not specified |
| CVE-2009-2516 | 7.1 | Oct 14 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which… Affected: All versions, or not specified |
| CVE-2013-1294 | 7.0 | Apr 9 | Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1,… Affected: All versions, or not specified |
| CVE-2013-1275 | 7.0 | Feb 13 | Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1,… Affected: All versions, or not specified |
| CVE-2013-1265 | 7.0 | Feb 13 | Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1,… Affected: All versions, or not specified |
| CVE-2013-1253 | 7.0 | Feb 13 | Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1,… Affected: All versions, or not specified |
| CVE-2010-0488 | 6.5 | Mar 31 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and… Affected: All versions, or not specified |
| CVE-2011-0096 | 6.1 | Jan 31 | The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7… Affected: All versions, or not specified |
| CVE-2010-0021 | 5.9 | Feb 10 | Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow… Affected: All versions, or not specified |
| CVE-2007-2237 | 5.5 | Jun 6 | Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader… Affected: All versions, or not specified |
| CVE-2006-2374 | 5.5 | Jun 13 | The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service… Affected: All versions, or not specified |
| CVE-2014-4971 | – | Jul 26 | Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain… Affected: All versions, or not specified |
| CVE-2014-0315 | – | Apr 8 | Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,… Affected: All versions, or not specified |
| CVE-2014-0323 | – | Mar 12 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows… Affected: All versions, or not specified |
| CVE-2014-0317 | – | Mar 12 | The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2… Affected: All versions, or not specified |
| CVE-2014-0301 | – | Mar 12 | Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… Affected: All versions, or not specified |
| CVE-2014-0300 | – | Mar 12 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows… Affected: All versions, or not specified |
| CVE-2014-0266 | – | Feb 12 | The XMLHTTP ActiveX controls in XML Core Services 3.0 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows… Affected: All versions, or not specified |
| CVE-2013-5058 | – | Dec 11 | Integer overflow in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,… Affected: All versions, or not specified |
| CVE-2013-5056 | – | Dec 11 | Use-after-free vulnerability in the Scripting Runtime Object Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and… Affected: All versions, or not specified |
| CVE-2013-3899 | – | Dec 11 | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate addresses, which allows local users to gain privileges via… Affected: All versions, or not specified |
| CVE-2013-3878 | – | Dec 11 | Stack-based buffer overflow in the LRPC client in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges by operating an LRPC server that sends… Affected: All versions, or not specified |
| CVE-2013-3876 | – | Nov 18 | DirectAccess in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,… Affected: All versions, or not specified |
| CVE-2013-3940 | – | Nov 13 | Integer overflow in the Graphics Device Interface (GDI) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,… Affected: All versions, or not specified |
| CVE-2013-3887 | – | Nov 13 | The Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2… Affected: All versions, or not specified |
| CVE-2013-3869 | – | Nov 13 | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold… Affected: All versions, or not specified |
| CVE-2013-3879 | – | Oct 9 | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and… Affected: All versions, or not specified |
| CVE-2013-3200 | – | Oct 9 | The USB drivers in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,… Affected: All versions, or not specified |
| CVE-2013-3195 | – | Oct 9 | The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2… Affected: All versions, or not specified |
| CVE-2013-3128 | – | Oct 9 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)