Microsoft SQL Server vulnerabilities

CVE-2023-36417 [HIGH] CWE-122 CVE-2023-36417: Microsoft SQL OLE DB Remote Code Execution Vulnerability Microsoft SQL OLE DB Remote Code Execution Vulnerability

CVE-2002-1145 [CRITICAL] CVE-2002-1145: The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by PUBLIC, which allows an attacker to gain privileges by updating a webtask that is owned by the database owner through the msdb.dbo.mswebtasks table, which does not ha

CVE-2023-32028 [HIGH] CWE-122 CVE-2023-32028: Microsoft SQL OLE DB Remote Code Execution Vulnerability Microsoft SQL OLE DB Remote Code Execution Vulnerability

CVE-2023-29349 [HIGH] CWE-191 CVE-2023-29349: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

CVE-2023-21704 [HIGH] CWE-190 CVE-2023-21704: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-36785 [HIGH] CWE-191 CVE-2023-36785: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-36730 [HIGH] CWE-122 CVE-2023-36730: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-36420 [HIGH] CWE-415 CVE-2023-36420: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-32026 [HIGH] CWE-122 CVE-2023-32026: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2002-0154 [HIGH] CVE-2002-0154: Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote at Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments.

CVE-2023-21718 [HIGH] CWE-191 CVE-2023-21718: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-29356 [HIGH] CWE-416 CVE-2023-29356: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-32025 [HIGH] CWE-122 CVE-2023-32025: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2023-32027 [HIGH] CWE-122 CVE-2023-32027: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

CVE-2019-0819 [MEDIUM] CVE-2019-0819: An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it imp An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka 'Microsoft SQL Server Analysis Services Information Disclosure Vulnerability'.

CVE-2001-0542 [HIGH] CVE-2001-0542: Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to e Buffer overflows in Microsoft SQL Server 7.0 and 2000 allow attackers with access to SQL Server to execute arbitrary code through the functions (1) raiserror, (2) formatmessage, or (3) xp_sprintf. NOTE: the C runtime format string vulnerability reported in MS01-060 is identified by CVE-2001-0879.

CVE-2011-1280 [MEDIUM] CWE-200 CVE-2011-1280: The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) f

CVE-2002-0641 [HIGH] CVE-2002-0641: Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Serve Buffer overflow in bulk insert procedure of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows attackers with database administration privileges to execute arbitrary code via a long filename in the BULK INSERT query.

CVE-2000-0202 [HIGH] CVE-2000-0202: Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0 allow remote attackers to gain privile Microsoft SQL Server 7.0 and Microsoft Data Engine (MSDE) 1.0 allow remote attackers to gain privileges via a malformed Select statement in an SQL query.

CVE-2002-1137 [HIGH] CVE-2002-1137: Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Ser Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a "non-SQL OLEDB data source" such as FoxPro, a variant of CAN-2002-0644.