Filtered by vendor Microsoft Subscriptions
Filtered by product Sql Server Subscriptions
Total 173 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2002-1123 1 Microsoft 2 Data Engine, Sql Server 2026-04-16 N/A
Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.
CVE-2002-0644 1 Microsoft 2 Data Engine, Sql Server 2026-04-16 N/A
Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code.
CVE-2002-0859 1 Microsoft 2 Jet, Sql Server 2026-04-16 N/A
Buffer overflow in the OpenDataSource function of the Jet engine on Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code.
CVE-2001-0344 1 Microsoft 1 Sql Server 2026-04-16 N/A
An SQL query method in Microsoft SQL Server 2000 Gold and 7.0 using Mixed Mode allows local database users to gain privileges by reusing a cached connection of the sa administrator account.
CVE-2003-0231 1 Microsoft 2 Data Engine, Sql Server 2026-04-16 N/A
Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a named pipe.
CVE-2000-1083 1 Microsoft 2 Data Engine, Sql Server 2026-04-16 N/A
The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling the srv_paraminfo function in the SQL Server API for Extended Stored Procedures (XP), which allows an attacker to cause a denial of service or execute arbitrary commands, aka the "Extended Stored Procedure Parameter Parsing" vulnerability.
CVE-2002-0186 1 Microsoft 1 Sql Server 2026-04-16 N/A
Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."
CVE-2000-0402 1 Microsoft 1 Sql Server 2026-04-16 N/A
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.
CVE-2000-0654 1 Microsoft 1 Sql Server 2026-04-16 N/A
Microsoft Enterprise Manager allows local users to obtain database passwords via the Data Transformation Service (DTS) package Registered Servers Dialog dialog, aka a variant of the "DTS Password" vulnerability.
CVE-2025-49717 1 Microsoft 3 Sql Server, Sql Server 2019, Sql Server 2022 2026-02-26 8.5 High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2025-24999 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-26 8.8 High
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-47954 1 Microsoft 2 Sql Server, Sql Server 2022 2026-02-26 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-59499 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-26 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-55227 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-20 8.8 High
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-49718 1 Microsoft 3 Sql Server, Sql Server 2019, Sql Server 2022 2026-02-13 7.5 High
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2025-49719 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2026-02-13 7.5 High
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2025-49759 1 Microsoft 6 Server, Sql Server, Sql Server 2016 and 3 more 2026-02-13 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-53727 1 Microsoft 6 Sql 2016 Azure Connect Feature Pack, Sql Server, Sql Server 2016 and 3 more 2026-02-13 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-49758 1 Microsoft 6 Sql 2016 Azure Connect Feature Pack, Sql Server, Sql Server 2016 and 3 more 2026-02-13 8.8 High
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2020-0618 1 Microsoft 1 Sql Server 2026-01-14 9.8 Critical
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.