XC
Product
XML Core Services
On CISA KEVExploited in the wild
19
CVEs
2
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 1Low 0
Watch
Add XML Core Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-1889 In wildKEV | 8.8 | Jun 13 | Microsoft XML Core Services Memory Corruption Vulnerability Affected: 3.0; 4.0; 6.0; 5.0 |
| CVE-2017-0022 In wildKEV | 6.5 | Mar 17 | Microsoft XML Core Services Information Disclosure Vulnerability Affected: 3.0 |
| CVE-2016-0147 | 8.8 | Apr 12 | Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." Affected: 3.0 |
| CVE-2013-0006 | 8.8 | Jan 9 | Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka… Affected: 3.0; 4.0; 6.0; 4.0; 6.0; 5.0 |
| CVE-2015-2471 | – | Aug 15 | Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network… Affected: 3.0; 5.0; 6.0 |
| CVE-2015-2440 | – | Aug 15 | Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure… Affected: 3.0; 5.0; 6.0 |
| CVE-2015-2434 | – | Aug 15 | Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and… Affected: 3.0; 5.0 |
| CVE-2015-1646 | – | Apr 14 | Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin… Affected: 3.0 |
| CVE-2014-1816 | – | Jun 11 | Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote… Affected: 3.0; 6.0 |
| CVE-2013-0007 | – | Jan 9 | Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka… Affected: 3.0; 4.0; 6.0; 4.0; 6.0; 5.0 |
| CVE-2010-2561 | – | Aug 11 | Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: 3.0 |
| CVE-2009-0419 | – | Feb 4 | Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to… Affected: All versions, or not specified |
| CVE-2008-4033 | – | Nov 12 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote… Affected: 4.0; 3.0; 6.0; 5.0 |
| CVE-2007-2223 | – | Aug 14 | Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which… Affected: 3.0; 4.0; 6.0; 4.0; 5.0 |
| CVE-2007-0099 | – | Jan 8 | Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or… Affected: 3.0 |
| CVE-2006-5745 | – | Nov 6 | Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet… Affected: 4.0 |
| CVE-2006-4685 | – | Oct 10 | The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote… Affected: 3.0; 4.0; 6.0 |
| CVE-2006-4686 | – | Oct 10 | Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers… Affected: 3.0; 4.0; 6.0 |
| CVE-2002-0057 | – | Mar 8 | XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by… Affected: 2.6; 3.0; 4.0 |
Showing 19