WX
Product
Windows XP
On CISA KEVExploited in the wild
738
CVEs
13
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 69Medium 5Low 0
Watch
Add Windows XP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-0917 | – | Mar 3 | Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, might allow user-assisted remote… Affected: All versions, or not specified |
| CVE-2010-0483 | – | Mar 3 | vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote… Affected: All versions, or not specified |
| CVE-2010-0719 | – | Feb 26 | An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local… Affected: All versions, or not specified |
| CVE-2010-0252 | – | Feb 10 | The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3,… Affected: All versions, or not specified |
| CVE-2010-0250 | – | Feb 10 | Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on… Affected: All versions, or not specified |
| CVE-2010-0233 | – | Feb 10 | Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users… Affected: sp3 |
| CVE-2010-0231 | – | Feb 10 | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2010-0028 | – | Feb 10 | Integer overflow in Microsoft Paint in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted JPEG (.JPG) file, aka… Affected: All versions, or not specified |
| CVE-2010-0023 | – | Feb 10 | The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly kill processes after a logout, which allows local… Affected: All versions, or not specified |
| CVE-2010-0022 | – | Feb 10 | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2010-0020 | – | Feb 10 | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2010-0016 | – | Feb 10 | The SMB client implementation in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate response fields, which allows remote SMB servers and… Affected: All versions, or not specified |
| CVE-2010-0555 | – | Feb 4 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended… Affected: All versions, or not specified |
| CVE-2010-0027 | – | Jan 22 | The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003… Affected: All versions, or not specified |
| CVE-2010-0379 | – | Jan 21 | Multiple unspecified vulnerabilities in the Macromedia Flash ActiveX control in Adobe Flash Player 6, as distributed in Microsoft Windows XP SP2 and SP3, might allow remote… Affected: All versions, or not specified |
| CVE-2010-0018 | – | Jan 13 | Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1,… Affected: All versions, or not specified |
| CVE-2009-4313 | – | Dec 13 | ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (heap… Affected: All versions, or not specified |
| CVE-2009-4312 | – | Dec 13 | Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media… Affected: All versions, or not specified |
| CVE-2009-4311 | – | Dec 13 | Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media… Affected: All versions, or not specified |
| CVE-2009-4310 | – | Dec 13 | Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2009-4309 | – | Dec 13 | Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2009-4210 | – | Dec 13 | The Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (memory corruption) or possibly have… Affected: All versions, or not specified |
| CVE-2009-3677 | – | Dec 9 | The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the… Affected: All versions, or not specified |
| CVE-2009-3675 | – | Dec 9 | LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote authenticated users to cause a… Affected: All versions, or not specified |
| CVE-2009-3674 | – | Dec 9 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly… Affected: All versions, or not specified |
| CVE-2009-3673 | – | Dec 9 | Microsoft Internet Explorer 7 and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not… Affected: All versions, or not specified |
| CVE-2009-2506 | – | Dec 9 | Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4, XP SP2 and SP3, and… Affected: All versions, or not specified |
| CVE-2009-2514 | – | Nov 11 | win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not correctly parse font code during construction of a directory-entry table,… Affected: All versions, or not specified |
| CVE-2009-2513 | – | Nov 11 | The Graphics Device Interface (GDI) in win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and… Affected: All versions, or not specified |
| CVE-2009-1928 | – | Nov 11 | Stack consumption vulnerability in the LDAP service in Active Directory on Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2; Active Directory Application… Affected: All versions, or not specified |
| CVE-2009-1127 | – | Nov 11 | win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not correctly validate an… Affected: All versions, or not specified |
| CVE-2009-3126 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: All versions, or not specified |
| CVE-2009-2531 | – | Oct 14 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1)… Affected: All versions, or not specified |
| CVE-2009-2530 | – | Oct 14 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1)… Affected: All versions, or not specified |
| CVE-2009-2528 | – | Oct 14 | GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted… Affected: All versions, or not specified |
| CVE-2009-2525 | – | Oct 14 | Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize… Affected: All versions, or not specified |
| CVE-2009-2524 | – | Oct 14 | Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,… Affected: All versions, or not specified |
| CVE-2009-2515 | – | Oct 14 | Integer underflow in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows local users to gain… Affected: All versions, or not specified |
| CVE-2009-2511 | – | Oct 14 | Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008… Affected: All versions, or not specified |
| CVE-2009-2510 | – | Oct 14 | The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2,… Affected: All versions, or not specified |
| CVE-2009-2507 | – | Oct 14 | A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly process URLs, which allows remote attackers… Affected: All versions, or not specified |
| CVE-2009-2504 | – | Oct 14 | Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista… Affected: All versions, or not specified |
| CVE-2009-2503 | – | Oct 14 | GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: All versions, or not specified |
| CVE-2009-2501 | – | Oct 14 | Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office… Affected: All versions, or not specified |
| CVE-2009-2500 | – | Oct 14 | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project… Affected: All versions, or not specified |
| CVE-2009-2497 | – | Oct 14 | The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote… Affected: All versions, or not specified |
| CVE-2009-0555 | – | Oct 14 | Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced… Affected: All versions, or not specified |
| CVE-2009-0091 | – | Oct 14 | Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2009-0090 | – | Oct 14 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory,… Affected: All versions, or not specified |
| CVE-2009-2519 | – | Sep 8 | The DHTML Editing Component ActiveX control in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly format HTML markup, which allows remote attackers… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)