SQL Server
by Microsoft
CVEs (260)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-55002 | Hig | 0.00 | 8.8 | 0.01 | Jul 14, 2026 | External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2026-54118 | Hig | 0.00 | 8.8 | 0.01 | Jul 14, 2026 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | ||
| CVE-2026-54117 | Hig | 0.00 | 8.8 | 0.01 | Jul 14, 2026 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | ||
| CVE-2026-47296 | Hig | 0.00 | 7.5 | 0.01 | Jul 14, 2026 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2003-0230 | 0.00 | — | 0.02 | Aug 27, 2003 | Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability. | |||
| CVE-2002-1981 | 0.00 | — | 0.05 | Dec 31, 2002 | Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings. | |||
| CVE-2002-1138 | 0.00 | — | 0.05 | Oct 11, 2002 | Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka… | |||
| CVE-2002-0645 | 0.00 | — | 0.04 | Aug 12, 2002 | SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands. | |||
| CVE-2002-0643 | 0.00 | — | 0.02 | Jul 23, 2002 | The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain… | |||
| CVE-2001-0344 | 0.00 | — | 0.02 | Jul 21, 2001 | An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account. | |||
| CVE-2000-1087 | 0.00 | — | 0.03 | Jan 9, 2001 | The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to… | |||
| CVE-2000-1082 | 0.00 | — | 0.03 | Jan 9, 2001 | The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a… | |||
| CVE-2000-1084 | 0.00 | — | 0.03 | Jan 9, 2001 | The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a… | |||
| CVE-2000-1086 | 0.00 | — | 0.03 | Jan 9, 2001 | The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to… | |||
| CVE-2000-1088 | 0.00 | — | 0.03 | Jan 9, 2001 | The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to… | |||
| CVE-2000-0654 | 0.00 | — | 0.01 | Jul 11, 2000 | Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability. | |||
| CVE-2000-0603 | 0.00 | — | 0.02 | Jul 7, 2000 | Microsoft SQL Server 7.0 allows a local user to bypass permissions for stored procedures by referencing them via a temporary stored procedure, aka the "Stored Procedure Permissions" vulnerability. | |||
| CVE-2000-0485 | 0.00 | — | 0.02 | May 30, 2000 | Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability. | |||
| CVE-2000-0199 | 0.00 | — | 0.01 | Mar 14, 2000 | When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password. | |||
| CVE-1999-1556 | 0.00 | — | 0.02 | Jun 29, 1998 | Microsoft SQL Server 6.5 uses weak encryption for the password for the SQLExecutiveCmdExec account and stores it in an accessible portion of the registry, which could allow local users to gain privileges by reading and decrypting the CmdExecAccount value. |
- risk 0.00cvss 8.8epss 0.01
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
- risk 0.00cvss 8.8epss 0.01
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- risk 0.00cvss 8.8epss 0.01
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- risk 0.00cvss 7.5epss 0.01
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- CVE-2003-0230Aug 27, 2003risk 0.00cvss —epss 0.02
Microsoft SQL Server 7, 2000, and MSDE allows local users to gain privileges by hijacking a named pipe during the authentication of another user, aka the "Named Pipe Hijacking" vulnerability.
- CVE-2002-1981Dec 31, 2002risk 0.00cvss —epss 0.05
Microsoft SQL Server 2000 through SQL Server 2000 SP2 allows the "public" role to execute the (1) sp_MSSetServerProperties or (2) sp_MSsetalertinfo stored procedures, which allows attackers to modify configuration including SQL server startup and alert settings.
- CVE-2002-1138Oct 11, 2002risk 0.00cvss —epss 0.05
Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files for scheduled jobs under its own privileges instead of the entity that launched it, which allows attackers to overwrite system files, aka…
- CVE-2002-0645Aug 12, 2002risk 0.00cvss —epss 0.04
SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands.
- CVE-2002-0643Jul 23, 2002risk 0.00cvss —epss 0.02
The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted passwords, to gain…
- CVE-2001-0344Jul 21, 2001risk 0.00cvss —epss 0.02
An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.
- CVE-2000-1087Jan 9, 2001risk 0.00cvss —epss 0.03
The xp_proxiedmetadata function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to…
- CVE-2000-1082Jan 9, 2001risk 0.00cvss —epss 0.03
The xp_enumresultset function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a…
- CVE-2000-1084Jan 9, 2001risk 0.00cvss —epss 0.03
The xp_updatecolvbm function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a…
- CVE-2000-1086Jan 9, 2001risk 0.00cvss —epss 0.03
The xp_printstatements function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to…
- CVE-2000-1088Jan 9, 2001risk 0.00cvss —epss 0.03
The xp_SetSQLSecurity function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to…
- CVE-2000-0654Jul 11, 2000risk 0.00cvss —epss 0.01
Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability.
- CVE-2000-0603Jul 7, 2000risk 0.00cvss —epss 0.02
Microsoft SQL Server 7.0 allows a local user to bypass permissions for stored procedures by referencing them via a temporary stored procedure, aka the "Stored Procedure Permissions" vulnerability.
- CVE-2000-0485May 30, 2000risk 0.00cvss —epss 0.02
Microsoft SQL Server allows local users to obtain database passwords via the Data Transformation Service (DTS) package Properties dialog, aka the "DTS Password" vulnerability.
- CVE-2000-0199Mar 14, 2000risk 0.00cvss —epss 0.01
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.
- CVE-1999-1556Jun 29, 1998risk 0.00cvss —epss 0.02
Microsoft SQL Server 6.5 uses weak encryption for the password for the SQLExecutiveCmdExec account and stores it in an accessible portion of the registry, which could allow local users to gain privileges by reading and decrypting the CmdExecAccount value.
Page 13 of 13