WX
Product
Windows XP
On CISA KEVExploited in the wild
738
CVEs
13
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 69Medium 5Low 0
Watch
Add Windows XP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-2563 | – | Sep 15 | The Word 97 text converter in the WordPad Text Converters in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly parse malformed structures in Word 97… Affected: All versions, or not specified |
| CVE-2010-1891 | – | Sep 15 | The Client/Server Runtime Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2, when a Chinese, Japanese, or Korean locale is… Affected: All versions, or not specified |
| CVE-2010-0818 | – | Sep 15 | The MPEG-4 codec in the Windows Media codecs in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly handle crafted… Affected: All versions, or not specified |
| CVE-2010-2739 | – | Sep 7 | Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2… Affected: All versions, or not specified |
| CVE-2010-3147 | – | Aug 27 | Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2,… Affected: All versions, or not specified |
| CVE-2010-3144 | – | Aug 27 | Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a… Affected: All versions, or not specified |
| CVE-2010-3140 | – | Aug 27 | Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users, and possibly remote attackers, to execute arbitrary… Affected: All versions, or not specified |
| CVE-2010-3138 | – | Aug 27 | Untrusted search path vulnerability in the Indeo Codec in iac25_32.ax in Microsoft Windows XP SP3 allows local users to gain privileges via a Trojan horse iacenc.dll file in the… Affected: All versions, or not specified |
| CVE-2010-1886 | – | Aug 16 | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 SP2 and R2, and Windows 7 allow local users to gain privileges by… Affected: All versions, or not specified |
| CVE-2010-2566 | – | Aug 11 | The Secure Channel (aka SChannel) security package in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, does not properly validate certificate request messages from… Affected: All versions, or not specified |
| CVE-2010-2553 | – | Aug 11 | The Cinepak codec in Microsoft Windows XP SP2 and SP3, Windows Vista SP1 and SP2, and Windows 7 does not properly decompress media files, which allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2010-2550 | – | Aug 11 | The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly… Affected: All versions, or not specified |
| CVE-2010-1897 | – | Aug 11 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and… Affected: All versions, or not specified |
| CVE-2010-1895 | – | Aug 11 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, do not properly perform memory allocation before copying user-mode… Affected: All versions, or not specified |
| CVE-2010-1894 | – | Aug 11 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, do not properly handle unspecified exceptions, which allows local… Affected: All versions, or not specified |
| CVE-2010-1888 | – | Aug 11 | Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization… Affected: All versions, or not specified |
| CVE-2010-1887 | – | Aug 11 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and… Affected: All versions, or not specified |
| CVE-2010-1882 | – | Aug 11 | Multiple buffer overflows in the MPEG Layer-3 Audio Codec for Microsoft DirectShow in l3codecx.ax in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to… Affected: All versions, or not specified |
| CVE-2010-2265 | – | Jun 15 | Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003… Affected: All versions, or not specified |
| CVE-2010-1885 | – | Jun 15 | The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences,… Affected: All versions, or not specified |
| CVE-2010-1255 | – | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server… Affected: All versions, or not specified |
| CVE-2010-0811 | – | Jun 8 | Multiple unspecified vulnerabilities in the Microsoft Internet Explorer 8 Developer Tools ActiveX control in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server… Affected: All versions, or not specified |
| CVE-2010-0484 | – | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly… Affected: All versions, or not specified |
| CVE-2010-0819 | – | Jun 8 | Unspecified vulnerability in the Windows OpenType Compact Font Format (CFF) driver in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008… Affected: All versions, or not specified |
| CVE-2010-1690 | – | May 7 | The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows… Affected: All versions, or not specified |
| CVE-2010-1689 | – | May 7 | The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows… Affected: All versions, or not specified |
| CVE-2010-1735 | – | May 6 | The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c… Affected: sp3; sp3 |
| CVE-2010-1734 | – | May 6 | The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d… Affected: sp3; sp3 |
| CVE-2010-0812 | – | Apr 14 | Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to bypass intended IPv4 source-address… Affected: All versions, or not specified |
| CVE-2010-0487 | – | Apr 14 | The Authenticode Signature verification functionality in cabview.dll in Cabinet File Viewer Shell Extension 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and… Affected: All versions, or not specified |
| CVE-2010-0486 | – | Apr 14 | The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista… Affected: All versions, or not specified |
| CVE-2010-0480 | – | Apr 14 | Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008… Affected: All versions, or not specified |
| CVE-2010-0269 | – | Apr 14 | The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows… Affected: All versions, or not specified |
| CVE-2010-0268 | – | Apr 14 | Unspecified vulnerability in the Windows Media Player ActiveX control in Windows Media Player (WMP) 9 on Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2010-0238 | – | Apr 14 | Unspecified vulnerability in registry-key validation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold allows local users to cause a… Affected: All versions, or not specified |
| CVE-2010-0237 | – | Apr 14 | The kernel in Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows local users to gain privileges by creating a symbolic link from an untrusted registry hive to a trusted registry… Affected: All versions, or not specified |
| CVE-2010-0236 | – | Apr 14 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not properly allocate memory for the destination key associated with a symbolic-link… Affected: All versions, or not specified |
| CVE-2010-0235 | – | Apr 14 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold does not perform the expected validation before creating a symbolic link, which allows… Affected: All versions, or not specified |
| CVE-2010-0234 | – | Apr 14 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate a registry-key… Affected: All versions, or not specified |
| CVE-2010-0025 | – | Apr 14 | The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate… Affected: All versions, or not specified |
| CVE-2010-0024 | – | Apr 14 | The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX… Affected: All versions, or not specified |
| CVE-2010-0807 | – | Mar 31 | Microsoft Internet Explorer 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, leading to memory… Affected: All versions, or not specified |
| CVE-2010-0805 | – | Mar 31 | The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code… Affected: All versions, or not specified |
| CVE-2010-0494 | – | Mar 31 | Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site… Affected: All versions, or not specified |
| CVE-2010-0491 | – | Mar 31 | Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML… Affected: All versions, or not specified |
| CVE-2010-0490 | – | Mar 31 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1)… Affected: All versions, or not specified |
| CVE-2010-0489 | – | Mar 31 | Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory… Affected: All versions, or not specified |
| CVE-2010-0267 | – | Mar 31 | Microsoft Internet Explorer 6, 6 SP1, and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was… Affected: All versions, or not specified |
| CVE-2010-1098 | – | Mar 24 | The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory… Affected: All versions, or not specified |
| CVE-2010-0265 | – | Mar 10 | Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via a crafted project (.MSWMM)… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)