[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEwZ7ByY418hsRYbIGxjaZV-WFZpqIwr5L3lKPmAlJRQ":3,"g5a-family:microsoft\u002Fxml_core_services":142,"g5a-ex:microsoft\u002Fxml_core_services@*":143},{"success":4,"data":5},true,{"product":6,"versions":37,"topVulnerabilitiesByEpss":46,"kevVulnerabilities":107,"seoMetadata":121,"meta":140},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":36},"microsoft","xml_core_services",8,19,2,"2017-03-17",[14,18,20,22,25,28,31,33],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"1.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"2.0",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"2.5",{"version":23,"cve_count":24,"kev_count":16,"has_kev":17},"2.6",1,{"version":26,"cve_count":27,"kev_count":11,"has_kev":4},"3.0",17,{"version":29,"cve_count":30,"kev_count":24,"has_kev":4},"4.0",9,{"version":32,"cve_count":9,"kev_count":24,"has_kev":4},"5.0",{"version":34,"cve_count":35,"kev_count":24,"has_kev":4},"6.0",10,"Xml Core Services by Microsoft is a technology product with 8 tracked versions and 19 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[38,39,40,41,42,43,44,45],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":24,"kev_count":16,"has_kev":17},{"version":26,"cve_count":27,"kev_count":11,"has_kev":4},{"version":29,"cve_count":30,"kev_count":24,"has_kev":4},{"version":32,"cve_count":9,"kev_count":24,"has_kev":4},{"version":34,"cve_count":35,"kev_count":24,"has_kev":4},[47,55,62,69,74,80,84,91,96,101],{"cveId":48,"description":49,"publishedDate":50,"cvssScore":51,"cvssVersion":52,"severity":53,"isKev":4,"epssScore":54},"CVE-2012-1889","Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.","2012-06-13",8.8,"v3.1","High",0.83516,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":60,"severity":53,"isKev":17,"epssScore":61},"CVE-2006-5745","Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to execute arbitrary code via crafted arguments that lead to memory corruption, a different vulnerability than CVE-2006-4685.  NOTE: some of these details are obtained from third party information.","2006-11-06",7.6,"v2",0.77594,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":60,"severity":67,"isKev":17,"epssScore":68},"CVE-2007-2223","Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.","2007-08-14",9.3,"Critical",0.48722,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":66,"cvssVersion":60,"severity":67,"isKev":17,"epssScore":73},"CVE-2013-0007","Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka \"MSXML XSLT Vulnerability.\"","2013-01-09",0.31574,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":78,"cvssVersion":60,"severity":53,"isKev":17,"epssScore":79},"CVE-2006-4686","Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.","2006-10-10",7.5,0.30338,{"cveId":81,"description":82,"publishedDate":72,"cvssScore":51,"cvssVersion":52,"severity":53,"isKev":17,"epssScore":83},"CVE-2013-0006","Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka \"MSXML Integer Truncation Vulnerability.\"",0.28084,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":88,"cvssVersion":60,"severity":89,"isKev":17,"epssScore":90},"CVE-2008-4033","Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka \"MSXML Header Request Vulnerability.\"","2008-11-12",4.3,"Medium",0.27747,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":66,"cvssVersion":60,"severity":67,"isKev":17,"epssScore":95},"CVE-2007-0099","Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka \"MSXML Memory Corruption Vulnerability.\"","2007-01-08",0.25652,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":66,"cvssVersion":60,"severity":67,"isKev":17,"epssScore":100},"CVE-2010-2561","Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted response, aka \"Msxml2.XMLHTTP.3.0 Response Handling Memory Corruption Vulnerability.\"","2010-08-11",0.24865,{"cveId":102,"description":103,"publishedDate":104,"cvssScore":105,"cvssVersion":60,"severity":89,"isKev":17,"epssScore":106},"CVE-2002-0057","XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.","2002-03-08",5,0.23231,[108,113],{"cveId":48,"description":49,"publishedDate":50,"cvssScore":51,"severity":53,"isKev":4,"epssScore":54,"cisaVulnName":109,"cisaDateAdded":110,"cisaShortDescription":111,"cisaRequiredAction":112},"Microsoft XML Core Services Memory Corruption Vulnerability","2022-06-08","Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.","Apply updates per vendor instructions.",{"cveId":114,"description":115,"publishedDate":12,"cvssScore":116,"severity":89,"isKev":4,"epssScore":117,"cisaVulnName":118,"cisaDateAdded":119,"cisaShortDescription":120,"cisaRequiredAction":112},"CVE-2017-0022","Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka \"Microsoft XML Information Disclosure Vulnerability.\"",6.5,0.18069,"Microsoft XML Core Services Information Disclosure Vulnerability","2022-05-24","Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.",{"title":122,"metaDescription":123,"keywords":124,"structuredData":125},"Xml Core Services by Microsoft - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Xml Core Services by Microsoft covering 8 versions with 19 tracked vulnerabilities including 0 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Xml Core Services vulnerabilities, Xml Core Services security, Xml Core Services CVE, Microsoft Xml Core Services, Xml Core Services threat intelligence, Microsoft security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Xml Core Services KEV, Xml Core Services exploited vulnerabilities",{"@context":126,"@type":127,"name":128,"description":123,"url":129,"manufacturer":130,"applicationCategory":134,"softwareVersion":135,"mainEntity":136},"https:\u002F\u002Fschema.org","SoftwareApplication","Xml Core Services","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fmicrosoft\u002Fxml_core_services",{"@type":131,"name":132,"url":133},"Organization","Microsoft","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fmicrosoft","Security Software","8 versions tracked",{"@type":137,"name":138,"description":139,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Xml Core Services Security Vulnerabilities","Security vulnerabilities affecting Xml Core Services by Microsoft",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":141,"apiVersion":26},"2026-10-17T21:37:23.384Z",[],{"rows":144,"total":11,"capped":17,"failed":16},[145,149],{"cveId":48,"name":109,"severity":53,"cvss":51,"added":110,"epss":54,"published":146,"ranges":147,"checked":4,"hits":148,"covers":17},"2012-06-13T04:46:46.19",[26,29,32,34],[],{"cveId":114,"name":118,"severity":89,"cvss":116,"added":119,"epss":117,"published":150,"ranges":151,"checked":4,"hits":152,"covers":17},"2017-03-17T00:59:00.68",[26],[]]