Microsoft Data Engine vulnerabilities

26 CVEs affecting Microsoft Data Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2008-0107, published 2008-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2000-1209, published 2002-08-12. High severity, CVSS 10.0. EPSS: 87.3% chance of exploitation in the next 30 days. The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products…
CVE-2002-0649, published 2002-08-12. High severity, CVSS 7.5. EPSS: 84.8% chance of exploitation in the next 30 days. Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary…
CVE-2002-1123, published 2002-09-24. High severity, CVSS 7.5. EPSS: 77.7% chance of exploitation in the next 30 days. Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port…
CVE-2008-0086, published 2008-07-08. High severity, CVSS 9.0. EPSS: 61.9% chance of exploitation in the next 30 days. Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary…
CVE-2002-0721, published 2002-09-05. High severity, CVSS 10.0. EPSS: 46.3% chance of exploitation in the next 30 days. Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote…
CVE-2003-0231, published 2003-08-27. Medium severity, CVSS 5.0. EPSS: 36.2% chance of exploitation in the next 30 days. Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe.
CVE-2008-0106, published 2008-07-08. High severity, CVSS 9.0. EPSS: 35.3% chance of exploitation in the next 30 days. Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
CVE-2008-0107, published 2008-07-08. High severity, CVSS 9.0. EPSS: 34.5% chance of exploitation in the next 30 days. Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine…
CVE-2002-0644, published 2002-08-12. High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days. Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute…
CVE-2008-0085, published 2008-07-08. Medium severity, CVSS 5.0. EPSS: 10.7% chance of exploitation in the next 30 days. SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and…

Latest

CVE-2003-0232, published 2003-08-27. High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days. Microsoft SQL Server 7, 2000, and MSDE allows local users to execute arbitrary code via a certain request to the Local Procedure Calls (LPC) port that leads to a buffer overflow.
CVE-2003-0230, published 2003-08-27. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability.
CVE-2002-1145, published 2002-10-28. High severity, CVSS 10.0. EPSS: 8.3% chance of exploitation in the next 30 days. The xp_runwebtask stored procedure in the Web Tasks component of Microsoft SQL Server 7.0 and 2000, Microsoft Data Engine (MSDE) 1.0, and Microsoft Desktop Engine (MSDE) 2000 can be executed by…
CVE-2002-1138, published 2002-10-11. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the…
CVE-2002-1137, published 2002-10-11. High severity, CVSS 7.5. EPSS: 9.4% chance of exploitation in the next 30 days. Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE)…