Microsoft Windows Server 2008 Service Pack 2 vulnerabilities
1,694 known vulnerabilities affecting microsoft/windows_server_2008_service_pack_2.
Total CVEs
1,694
CISA KEV
67
actively exploited
Public exploits
64
Exploited in wild
89
Severity breakdown
CRITICAL69HIGH1231MEDIUM391LOW3
Vulnerabilities
Page 75 of 85
CVE-2025-21268P4MEDIUMCVSS 4.3≥ 6.0.6003.0, < 6.0.6003.230702025-01-14
CVE-2025-21268 [MEDIUM] CWE-41 CVE-2025-21268: MapUrlToZone Security Feature Bypass Vulnerability
MapUrlToZone Security Feature Bypass Vulnerability
nvd
CVE-2026-20834P4MEDIUMCVSS 4.6≥ 6.0.6003.0, < 6.0.6003.237172026-01-13
CVE-2026-20834 [MEDIUM] CWE-36 CVE-2026-20834: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a
Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
nvd
CVE-2021-1699P4MEDIUMCVSS 5.5≥ 6.0.0, < publication2021-01-12
CVE-2021-1699 [MEDIUM] CVE-2021-1699: Windows (modem.sys) Information Disclosure Vulnerability
Windows (modem.sys) Information Disclosure Vulnerability
nvd
CVE-2020-16940P4MEDIUMCVSS 5.5≥ 6.0.0, < publication2020-10-16
CVE-2020-16940 [MEDIUM] CWE-269 CVE-2020-16940: <p>An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) im
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles junction points. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then
nvd
CVE-2023-28271P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.220152023-04-11
CVE-2023-28271 [MEDIUM] CWE-200 CVE-2023-28271: Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
nvd
CVE-2020-1083P4MEDIUMCVSS 5.5≥ 6.0.0, < publication2020-09-11
CVE-2020-1083 [MEDIUM] CVE-2020-1083: <p>An information disclosure vulnerability exists when the Microsoft Windows Graphics Component impr
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially c
nvd
CVE-2020-1250P4MEDIUMCVSS 5.5≥ 6.0.0, < publication2020-09-11
CVE-2020-1250 [MEDIUM] CVE-2020-1250: <p>An information disclosure vulnerability exists when the win32k component improperly provides kern
An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application
nvd
CVE-2023-21525P4MEDIUMCVSS 5.3≥ 6.0.6003.0, < 6.0.6003.218722023-01-10
CVE-2023-21525 [MEDIUM] CVE-2023-21525: Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
nvd
CVE-2025-21320P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.230702025-01-14
CVE-2025-21320 [MEDIUM] CWE-532 CVE-2025-21320: Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
nvd
CVE-2025-27742P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-27742 [MEDIUM] CWE-125 CVE-2025-27742: Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
nvd
CVE-2024-30039P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.226682024-05-14
CVE-2024-30039 [MEDIUM] CWE-126 CVE-2024-30039: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-38203P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.229662024-11-12
CVE-2024-38203 [MEDIUM] CWE-693 CVE-2024-38203: Windows Package Library Manager Information Disclosure Vulnerability
Windows Package Library Manager Information Disclosure Vulnerability
nvd
CVE-2024-38118P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.228252024-08-13
CVE-2024-38118 [MEDIUM] CWE-908 CVE-2024-38118: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
nvd
CVE-2024-38122P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.228252024-08-13
CVE-2024-38122 [MEDIUM] CWE-908 CVE-2024-38122: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
nvd
CVE-2025-21328P4MEDIUMCVSS 4.3≥ 6.0.6003.0, < 6.0.6003.230702025-01-14
CVE-2025-21328 [MEDIUM] CWE-41 CVE-2025-21328: MapUrlToZone Security Feature Bypass Vulnerability
MapUrlToZone Security Feature Bypass Vulnerability
nvd
CVE-2025-21329P4MEDIUMCVSS 4.3≥ 6.0.6003.0, < 6.0.6003.230702025-01-14
CVE-2025-21329 [MEDIUM] CWE-41 CVE-2025-21329: MapUrlToZone Security Feature Bypass Vulnerability
MapUrlToZone Security Feature Bypass Vulnerability
nvd
CVE-2025-54107P4MEDIUMCVSS 4.3≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-54107 [MEDIUM] CWE-41 CVE-2025-54107: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2025-54917P4MEDIUMCVSS 4.3≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-54917 [MEDIUM] CWE-693 CVE-2025-54917: Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a sec
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2023-35642P4MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.224132023-12-12
CVE-2023-35642 [MEDIUM] CWE-682 CVE-2023-35642: Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
nvd
CVE-2025-21352P4MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.231172025-02-11
CVE-2025-21352 [MEDIUM] CWE-400 CVE-2025-21352: Internet Connection Sharing (ICS) Denial of Service Vulnerability
Internet Connection Sharing (ICS) Denial of Service Vulnerability
nvd