Microsoft Windows Server 2008 vulnerabilities
3,037 known vulnerabilities affecting microsoft/windows_server_2008.
Total CVEs
3,037
CISA KEV
133
actively exploited
Public exploits
363
Exploited in wild
187
Severity breakdown
CRITICAL180HIGH1977MEDIUM841LOW39
Vulnerabilities
Page 122 of 152
CVE-2024-21439P4HIGHCVSS 7.0vr22024-03-12
CVE-2024-21439 [HIGH] CWE-416 CVE-2024-21439: Windows Telephony Server Elevation of Privilege Vulnerability
Windows Telephony Server Elevation of Privilege Vulnerability
nvd
CVE-2022-26827P4HIGHCVSS 7.0vr22022-04-15
CVE-2022-26827 [HIGH] CWE-362 CVE-2022-26827: Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
nvd
CVE-2024-26242P4HIGHCVSS 7.0vr22024-04-09
CVE-2024-26242 [HIGH] CWE-591 CVE-2024-26242: Windows Telephony Server Elevation of Privilege Vulnerability
Windows Telephony Server Elevation of Privilege Vulnerability
nvd
CVE-2024-30063P4MEDIUMCVSS 6.7vr2-sp12024-06-11
CVE-2024-30063 [MEDIUM] CWE-641 CVE-2024-30063: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
nvd
CVE-2025-49678P4HIGHCVSS 7.0vr22025-07-08
CVE-2025-49678 [HIGH] CWE-362 CVE-2025-49678: Null pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally
Null pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
nvd
CVE-2019-0614P4MEDIUMCVSS 6.5vr22019-04-08
CVE-2019-0614 [MEDIUM] CVE-2019-0614: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0774.
nvd
CVE-2020-0774P4MEDIUMCVSS 6.5vr22020-03-12
CVE-2020-0774 [MEDIUM] CVE-2020-0774: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0874, CVE-2020-0879, CVE-2020-0880, CVE-2020-0882.
nvd
CVE-2019-1286P4MEDIUMCVSS 6.5vr22019-09-11
CVE-2019-1286 [MEDIUM] CVE-2019-1286: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1252.
nvd
CVE-2025-29954P4MEDIUMCVSS 5.9vr22025-05-13
CVE-2025-29954 [MEDIUM] CWE-400 CVE-2025-29954: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2019-1466P4MEDIUMCVSS 6.5vr22019-12-10
CVE-2019-1466 [MEDIUM] CVE-2019-1466: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1467.
nvd
CVE-2019-1465P4MEDIUMCVSS 6.5vr22019-12-10
CVE-2019-1465 [MEDIUM] CWE-125 CVE-2019-1465: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1466, CVE-2019-1467.
nvd
CVE-2019-1467P4MEDIUMCVSS 6.5vr22019-12-10
CVE-2019-1467 [MEDIUM] CVE-2019-1467: An information disclosure vulnerability exists when the Windows GDI component improperly discloses t
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1466.
nvd
CVE-2020-0993P4MEDIUMCVSS 6.5vr22020-04-15
CVE-2020-0993 [MEDIUM] CVE-2020-0993: A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, ak
A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'.
nvd
CVE-2025-53719P4MEDIUMCVSS 5.7vr22025-08-12
CVE-2025-53719 [MEDIUM] CWE-908 CVE-2025-53719: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.
nvd
CVE-2025-50156P4MEDIUMCVSS 5.7vr22025-08-12
CVE-2025-50156 [MEDIUM] CWE-908 CVE-2025-50156: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.
nvd
CVE-2017-0269P4MEDIUMCVSS 5.9vr22017-05-12
CVE-2017-0269 [MEDIUM] CWE-20 CVE-2017-0269: The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends speci
The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability". This CVE ID is unique from CVE-2017-0273 and CVE-2017-0280.
nvd
CVE-2017-0273P4MEDIUMCVSS 5.9vr22017-05-12
CVE-2017-0273 [MEDIUM] CVE-2017-0273: The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends speci
The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability". This CVE ID is unique from CVE-2017-0269 and CVE-2017-0280.
nvd
CVE-2015-2549P4HIGHCVSS 7.2vr22015-10-14
CVE-2015-2549 [HIGH] CWE-119 CVE-2015-2549: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability."
nvd
CVE-2026-20927P4MEDIUMCVSS 5.3vr2-sp12026-01-13
CVE-2026-20927 [MEDIUM] CWE-362 CVE-2026-20927: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network.
nvd
CVE-2014-1814P4HIGHCVSS 7.2vr22014-08-12
CVE-2014-1814 [HIGH] CWE-264 CVE-2014-1814: The Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S
The Windows Installer in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that invokes the repair feature for a different application, aka "Windows In
nvd