Microsoft Visual Studio .net vulnerabilities

27 CVEs affecting Microsoft Visual Studio .net, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-3129, published 2013-07-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2004-0204, published 2004-08-06. High severity, CVSS 7.5. EPSS: 72.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business…
CVE-2005-2127, published 2005-08-19. High severity, CVSS 7.5. EPSS: 63.7% chance of exploitation in the next 30 days. Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that…
CVE-2008-3704, published 2008-08-18. High severity, CVSS 9.3. EPSS: 55.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio…
CVE-2008-4255, published 2008-12-10. High severity, CVSS 9.3. EPSS: 53.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual…
CVE-2006-6133, published 2006-11-28. High severity, CVSS 7.6. EPSS: 52% chance of exploitation in the next 30 days. Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal…
CVE-2004-0200, published 2004-09-28. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with…
CVE-2006-4704, published 2006-11-01. Medium severity, CVSS 6.8. EPSS: 45.6% chance of exploitation in the next 30 days. Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass…
CVE-2007-0025, published 2007-02-13. High severity, CVSS 9.3. EPSS: 36.7% chance of exploitation in the next 30 days. The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an…
CVE-2009-0901, published 2009-07-29. High severity, CVSS 8.8. EPSS: 36.6% chance of exploitation in the next 30 days. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3,…
CVE-2009-2495, published 2009-07-29. Medium severity, CVSS 6.5. EPSS: 34.3% chance of exploitation in the next 30 days. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce…

Latest

CVE-2013-3129, published 2013-07-10. High severity, CVSS 7.8. EPSS: 32.4% chance of exploitation in the next 30 days. Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+, DirectWrite, and Journal, in Windows XP SP2 and SP3,…
CVE-2010-3190, published 2010-08-31. High severity, CVSS 7.8. EPSS: 8.7% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008…
CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2528, published 2009-10-14. High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days. GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that…
CVE-2009-2504, published 2009-10-14. High severity, CVSS 9.3. EPSS: 21% chance of exploitation in the next 30 days. Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server…
CVE-2009-2503, published 2009-10-14. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio…
CVE-2009-2502, published 2009-10-14. High severity, CVSS 8.1. EPSS: 22% chance of exploitation in the next 30 days. Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2496, published 2009-08-12. High severity, CVSS 9.3. EPSS: 29.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web…