Microsoft SQL Server Reporting Services vulnerabilities

14 CVEs affecting Microsoft SQL Server Reporting Services, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1044, published 2020-09-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-5348, published 2008-09-11. High severity, CVSS 9.3. EPSS: 52.9% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft…
CVE-2008-3013, published 2008-09-11. High severity, CVSS 9.3. EPSS: 52.1% chance of exploitation in the next 30 days. gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft…
CVE-2008-3015, published 2008-09-11. High severity, CVSS 9.3. EPSS: 39.3% chance of exploitation in the next 30 days. Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image…
CVE-2008-3014, published 2008-09-11. High severity, CVSS 9.3. EPSS: 36.7% chance of exploitation in the next 30 days. Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3,…
CVE-2008-3012, published 2008-09-11. High severity, CVSS 9.3. EPSS: 31% chance of exploitation in the next 30 days. gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft…
CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2503, published 2009-10-14. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio…
CVE-2009-2502, published 2009-10-14. High severity, CVSS 8.1. EPSS: 22% chance of exploitation in the next 30 days. Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…

Latest

CVE-2020-1044, published 2020-09-11. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. <p>A security feature bypass vulnerability exists in SQL Server Reporting Services (SSRS) when the server improperly validates attachments uploaded to reports. An attacker who successfully exploited…
CVE-2012-2552, published 2012-10-09. Medium severity, CVSS 4.3. EPSS: 16.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP1, and 2012 allows…
CVE-2009-2528, published 2009-10-14. High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days. GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that…
CVE-2009-2504, published 2009-10-14. High severity, CVSS 9.3. EPSS: 21% chance of exploitation in the next 30 days. Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server…