Microsoft XML Core Services vulnerabilities

19 CVEs affecting Microsoft XML Core Services, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-0022, published 2017-03-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-1889: Microsoft XML Core Services Memory Corruption Vulnerability, published 2012-06-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-06-08. EPSS: 83.5% chance of exploitation in the next 30 days. Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)…
CVE-2017-0022: Microsoft XML Core Services Information Disclosure Vulnerability, published 2017-03-17. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 18.1% chance of exploitation in the next 30 days. Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server…
CVE-2006-5745, published 2006-11-06. High severity, CVSS 7.6. EPSS: 77.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote…
CVE-2007-2223, published 2007-08-14. High severity, CVSS 9.3. EPSS: 48.7% chance of exploitation in the next 30 days. Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer…
CVE-2013-0007, published 2013-01-09. High severity, CVSS 9.3. EPSS: 31.6% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT…
CVE-2006-4686, published 2006-10-10. High severity, CVSS 7.5. EPSS: 30.3% chance of exploitation in the next 30 days. Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary…
CVE-2013-0006, published 2013-01-09. High severity, CVSS 8.8. EPSS: 28.1% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer…
CVE-2008-4033, published 2008-11-12. Medium severity, CVSS 4.3. EPSS: 27.7% chance of exploitation in the next 30 days. Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain…
CVE-2007-0099, published 2007-01-08. High severity, CVSS 9.3. EPSS: 25.7% chance of exploitation in the next 30 days. Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of…
CVE-2010-2561, published 2010-08-11. High severity, CVSS 9.3. EPSS: 24.9% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a…

Latest

CVE-2016-0147, published 2016-04-12. High severity, CVSS 8.8. EPSS: 15.7% chance of exploitation in the next 30 days. Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability."
CVE-2015-2471, published 2015-08-15. Medium severity, CVSS 4.3. EPSS: 15.5% chance of exploitation in the next 30 days. Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a…
CVE-2015-2440, published 2015-08-15. Medium severity, CVSS 4.3. EPSS: 18.6% chance of exploitation in the next 30 days. Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure Vulnerability."
CVE-2015-2434, published 2015-08-15. Medium severity, CVSS 4.3. EPSS: 15.5% chance of exploitation in the next 30 days. Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption…
CVE-2015-1646, published 2015-04-14. Medium severity, CVSS 4.3. EPSS: 16.9% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB…
CVE-2014-1816, published 2014-06-11. Medium severity, CVSS 4.3. EPSS: 14.4% chance of exploitation in the next 30 days. Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1)…