[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRLtYubHLzdVTyXotDPms9TmKfUBxu2MTvJioMcW9PlI":3,"g5a-family:microsoft\u002Fsql_server":168,"g5a-ex:microsoft\u002Fsql_server@*":199},{"success":4,"data":5},true,{"product":6,"versions":54,"topVulnerabilitiesByEpss":68,"kevVulnerabilities":130,"seoMetadata":146,"meta":165},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":53},"microsoft","sql_server",13,110,2,"2024-01-09",[14,18,21,24,28,31,34,37,40,42,45,47,50],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},"2000",47,1,{"version":19,"cve_count":20,"kev_count":17,"has_kev":4},"2005",21,{"version":22,"cve_count":23,"kev_count":17,"has_kev":4},"2008",10,{"version":25,"cve_count":17,"kev_count":26,"has_kev":27},"2008_r2",0,false,{"version":29,"cve_count":30,"kev_count":17,"has_kev":4},"2012",16,{"version":32,"cve_count":33,"kev_count":17,"has_kev":4},"2014",18,{"version":35,"cve_count":36,"kev_count":17,"has_kev":4},"2016",17,{"version":38,"cve_count":39,"kev_count":26,"has_kev":27},"2017",12,{"version":41,"cve_count":20,"kev_count":26,"has_kev":27},"2019",{"version":43,"cve_count":44,"kev_count":26,"has_kev":27},"2022",19,{"version":46,"cve_count":17,"kev_count":26,"has_kev":27},"6.0",{"version":48,"cve_count":49,"kev_count":26,"has_kev":27},"6.5",4,{"version":51,"cve_count":52,"kev_count":26,"has_kev":27},"7.0",36,"Sql Server by Microsoft is a technology product with 13 tracked versions and 110 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[55,56,57,58,59,60,61,62,63,64,65,66,67],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},{"version":19,"cve_count":20,"kev_count":17,"has_kev":4},{"version":22,"cve_count":23,"kev_count":17,"has_kev":4},{"version":25,"cve_count":17,"kev_count":26,"has_kev":27},{"version":29,"cve_count":30,"kev_count":17,"has_kev":4},{"version":32,"cve_count":33,"kev_count":17,"has_kev":4},{"version":35,"cve_count":36,"kev_count":17,"has_kev":4},{"version":38,"cve_count":39,"kev_count":26,"has_kev":27},{"version":41,"cve_count":20,"kev_count":26,"has_kev":27},{"version":43,"cve_count":44,"kev_count":26,"has_kev":27},{"version":46,"cve_count":17,"kev_count":26,"has_kev":27},{"version":48,"cve_count":49,"kev_count":26,"has_kev":27},{"version":51,"cve_count":52,"kev_count":26,"has_kev":27},[69,77,85,92,98,103,108,113,119,124],{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"cvssVersion":74,"severity":75,"isKev":4,"epssScore":76},"CVE-2020-0618","A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.","2020-02-11",8.8,"v3.1","High",0.99046,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":82,"severity":83,"isKev":27,"epssScore":84},"CVE-2000-0402","The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the \"SQL Server 7.0 Service Pack Password\" vulnerability.","2000-05-30",2.1,"v2","Low",0.90609,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":27,"epssScore":91},"CVE-2008-5416","Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06; SQL Server 2000 Desktop Engine (WMSDE) on Windows Server 2003 SP1 and SP2; and Windows Internal Database (WYukon) SP2 allows remote authenticated users to cause a denial of service (access violation exception) or execute arbitrary code by calling the sp_replwritetovarbin extended stored procedure with a set of invalid parameters that trigger memory overwrite, aka \"SQL Server sp_replwritetovarbin Limited Memory Overwrite Vulnerability.\"","2008-12-10",9,"Critical",0.87036,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":82,"severity":75,"isKev":27,"epssScore":97},"CVE-2002-0649","Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer\u002FSapphire worm.","2002-08-12",7.5,0.8475,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":96,"cvssVersion":82,"severity":75,"isKev":27,"epssScore":102},"CVE-2002-1123","Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the \"Hello\" overflow.","2002-09-24",0.77712,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":73,"cvssVersion":74,"severity":75,"isKev":4,"epssScore":107},"CVE-2012-1856","The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka \"MSCOMCTL.OCX RCE Vulnerability.\"","2012-08-15",0.72032,{"cveId":109,"description":110,"publishedDate":111,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":27,"epssScore":112},"CVE-2008-0086","Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.","2008-07-08",0.61927,{"cveId":114,"description":115,"publishedDate":116,"cvssScore":73,"cvssVersion":117,"severity":75,"isKev":4,"epssScore":118},"CVE-2019-1068","A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.","2019-07-15","v3.0",0.57273,{"cveId":120,"description":121,"publishedDate":122,"cvssScore":96,"cvssVersion":82,"severity":75,"isKev":27,"epssScore":123},"CVE-2002-0186","Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka \"Unchecked Buffer in SQLXML ISAPI Extension.\"","2002-07-03",0.55455,{"cveId":125,"description":126,"publishedDate":127,"cvssScore":128,"cvssVersion":82,"severity":90,"isKev":27,"epssScore":129},"CVE-2007-5348","Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted gradient sizes in gradient fill input, which triggers a heap-based buffer overflow related to GdiPlus.dll and VGX.DLL, aka \"GDI+ VML Buffer Overrun Vulnerability.\"","2008-09-11",9.3,0.52886,[131,136,141],{"cveId":114,"description":115,"publishedDate":116,"cvssScore":73,"severity":75,"isKev":4,"epssScore":118,"cisaVulnName":132,"cisaDateAdded":133,"cisaShortDescription":134,"cisaRequiredAction":135},"Microsoft SQL Server Remote Code Execution Vulnerability","2026-08-26","Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"severity":75,"isKev":4,"epssScore":76,"cisaVulnName":137,"cisaDateAdded":138,"cisaShortDescription":139,"cisaRequiredAction":140},"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability","2024-09-18","Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":104,"description":105,"publishedDate":106,"cvssScore":73,"severity":75,"isKev":4,"epssScore":107,"cisaVulnName":142,"cisaDateAdded":143,"cisaShortDescription":144,"cisaRequiredAction":145},"Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability","2022-03-03","The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.","Apply updates per vendor instructions.",{"title":147,"metaDescription":148,"keywords":149,"structuredData":150},"Sql Server by Microsoft - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Sql Server by Microsoft covering 13 versions with 110 tracked vulnerabilities including 0 critical and 3 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Sql Server vulnerabilities, Sql Server security, Sql Server CVE, Microsoft Sql Server, Sql Server threat intelligence, Microsoft security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Sql Server KEV, Sql Server exploited vulnerabilities",{"@context":151,"@type":152,"name":153,"description":148,"url":154,"manufacturer":155,"applicationCategory":159,"softwareVersion":160,"mainEntity":161},"https:\u002F\u002Fschema.org","SoftwareApplication","Sql Server","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fmicrosoft\u002Fsql_server",{"@type":156,"name":157,"url":158},"Organization","Microsoft","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fmicrosoft","Security Software","13 versions tracked",{"@type":162,"name":163,"description":164,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Sql Server Security Vulnerabilities","Security vulnerabilities affecting Sql Server by Microsoft",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":166,"apiVersion":167},"2026-10-18T13:43:20.704Z","3.0",[169,172,175,178,181,184,187,189,191,193,195,197],{"product":170,"cves":171},"sql_server_2019",129,{"product":173,"cves":174},"sql_server_2022",100,{"product":176,"cves":177},"sql_server_2017",88,{"product":179,"cves":180},"sql_server_2016",86,{"product":182,"cves":183},"sql_server_reporting_services",14,{"product":185,"cves":186},"sql_server_management_studio",6,{"product":188,"cves":49},"sql_server_desktop_engine",{"product":190,"cves":11},"sql_server_express_edition",{"product":192,"cves":17},"sql_server_2019_reporting_services",{"product":194,"cves":17},"sql_server_2005",{"product":196,"cves":17},"sql_server_2008",{"product":198,"cves":17},"sql_server_2017_reporting_services",{"rows":200,"total":225,"capped":27,"failed":26},[201,209,214],{"cveId":114,"name":132,"severity":75,"cvss":73,"added":133,"epss":118,"published":202,"ranges":203,"checked":4,"hits":208,"covers":27},"2019-07-15T19:15:16.983",[204,205,206,207,38],"2014-sp2","2014-sp3","2016-sp1","2016-sp2",[],{"cveId":70,"name":137,"severity":75,"cvss":73,"added":138,"epss":76,"published":210,"ranges":211,"checked":4,"hits":213,"covers":27},"2020-02-11T22:15:13.4",[212,205,207],"2012-sp4",[],{"cveId":104,"name":142,"severity":75,"cvss":73,"added":143,"epss":107,"published":215,"ranges":216,"checked":4,"hits":224,"covers":27},"2012-08-15T01:55:01.49",[217,218,219,220,221,222,223],"2000-sp4","2005-sp3","2005-sp4","2008-r2_sp1","2008-r2_sp2","2008-sp2","2008-sp3",[],3]