WX
Product
Windows XP
On CISA KEVExploited in the wild
738
CVEs
13
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 69Medium 5Low 0
Watch
Add Windows XP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-2499 | – | Sep 8 | Microsoft Windows Media Format Runtime 9.0, 9.5, and 11; and Microsoft Media Foundation on Windows Vista Gold, SP1, and SP2 and Server 2008; allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2009-2498 | – | Sep 8 | Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in Advanced Systems Format (ASF) files,… Affected: All versions, or not specified |
| CVE-2009-1926 | – | Sep 8 | Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to cause a denial of service (TCP… Affected: All versions, or not specified |
| CVE-2009-1920 | – | Sep 8 | The JScript scripting engine 5.1, 5.6, 5.7, and 5.8 in JScript.dll in Microsoft Windows, as used in Internet Explorer, does not properly load decoded scripts into memory before… Affected: All versions, or not specified |
| CVE-2009-2196 | – | Aug 12 | Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via… Affected: All versions, or not specified |
| CVE-2009-1930 | – | Aug 12 | The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote Telnet servers to execute… Affected: All versions, or not specified |
| CVE-2009-1929 | – | Aug 12 | Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2; or 5.2 or 6.1… Affected: All versions, or not specified |
| CVE-2009-1922 | – | Aug 12 | The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user… Affected: All versions, or not specified |
| CVE-2009-1546 | – | Aug 12 | Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4… Affected: All versions, or not specified |
| CVE-2009-1545 | – | Aug 12 | Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and… Affected: All versions, or not specified |
| CVE-2009-1133 | – | Aug 12 | Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows, and Remote Desktop Connection Client… Affected: All versions, or not specified |
| CVE-2009-2653 | – | Aug 3 | The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows local administrators to bypass unspecified "security… Affected: All versions, or not specified |
| CVE-2009-1919 | – | Jul 29 | Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3,… Affected: All versions, or not specified |
| CVE-2009-1539 | – | Jul 15 | The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 does… Affected: All versions, or not specified |
| CVE-2009-1538 | – | Jul 15 | The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2… Affected: All versions, or not specified |
| CVE-2009-0232 | – | Jul 15 | Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2… Affected: All versions, or not specified |
| CVE-2008-0020 | – | Jul 7 | Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Microsoft Video ActiveX control in… Affected: All versions, or not specified |
| CVE-2009-1126 | – | Jun 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with the editing of an unspecified desktop… Affected: All versions, or not specified |
| CVE-2009-1125 | – | Jun 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate an argument to an unspecified… Affected: All versions, or not specified |
| CVE-2009-1124 | – | Jun 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate user-mode pointers in… Affected: All versions, or not specified |
| CVE-2009-0568 | – | Jun 10 | The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly maintain its… Affected: All versions, or not specified |
| CVE-2009-0230 | – | Jun 10 | The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows remote authenticated users to gain… Affected: All versions, or not specified |
| CVE-2009-0229 | – | Jun 10 | The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary… Affected: sp3 |
| CVE-2009-1808 | – | May 28 | Microsoft Windows XP SP3 allows local users to cause a denial of service (system crash) by making an SPI_SETDESKWALLPAPER SystemParametersInfo call with an improperly terminated… Affected: All versions, or not specified |
| CVE-2009-1511 | – | May 1 | GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain large btChunkLen value Affected: All versions, or not specified |
| CVE-2009-0550 | – | Apr 15 | Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet… Affected: All versions, or not specified |
| CVE-2009-0235 | – | Apr 15 | Stack-based buffer overflow in the Word 97 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2009-0089 | – | Apr 15 | Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https… Affected: All versions, or not specified |
| CVE-2009-0088 | – | Apr 15 | The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an… Affected: All versions, or not specified |
| CVE-2009-0087 | – | Apr 15 | Unspecified vulnerability in the Word 6 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and the Word 6 text converter in… Affected: All versions, or not specified |
| CVE-2009-0086 | – | Apr 15 | Integer underflow in Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote… Affected: All versions, or not specified |
| CVE-2009-0079 | – | Apr 15 | The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that (1) all run under… Affected: All versions, or not specified |
| CVE-2009-0078 | – | Apr 15 | The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement… Affected: All versions, or not specified |
| CVE-2009-0085 | – | Mar 10 | The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when… Affected: All versions, or not specified |
| CVE-2009-0083 | – | Mar 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 does not properly handle invalid pointers, which allows local users to gain privileges via an… Affected: All versions, or not specified |
| CVE-2009-0081 | – | Mar 10 | The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does… Affected: All versions, or not specified |
| CVE-2009-0320 | – | Jan 28 | Microsoft Windows XP, Server 2003 and 2008, and Vista exposes I/O activity measurements of all processes, which allows local users to obtain sensitive information, as demonstrated… Affected: All versions, or not specified |
| CVE-2009-0243 | – | Jan 21 | Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1)… Affected: All versions, or not specified |
| CVE-2009-0119 | – | Jan 14 | Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a… Affected: All versions, or not specified |
| CVE-2008-4834 | – | Jan 14 | Buffer overflow in SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via… Affected: All versions, or not specified |
| CVE-2008-2249 | – | Dec 10 | Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2008-4609 | – | Oct 20 | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to… Affected: All versions, or not specified |
| CVE-2008-4038 | – | Oct 15 | Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via… Affected: All versions, or not specified |
| CVE-2008-3464 | – | Oct 15 | afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not properly validate input sent from user… Affected: All versions, or not specified |
| CVE-2008-2252 | – | Oct 15 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate parameters sent from user mode to… Affected: All versions, or not specified |
| CVE-2008-2251 | – | Oct 15 | Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows local users to gain… Affected: All versions, or not specified |
| CVE-2008-2250 | – | Oct 15 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate window properties sent from a… Affected: All versions, or not specified |
| CVE-2008-4327 | – | Sep 30 | gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial of service (divide-by-zero error and… Affected: All versions, or not specified |
| CVE-2008-4323 | – | Sep 29 | Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file Affected: sp3 |
| CVE-2008-4114 | – | Sep 16 | srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)