Biztalk Server
Vendor:
First CVE: May 12, 2003 · Active for 23 years
8
Total CVEs
More Total CVEs than 85% of tracked products
1.3
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
8.2
Avg CVSS
Higher Avg CVSS than 72% of tracked products
12.5%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Biztalk Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 12, 2003
23 years ago
Most Recent CVE
Aug 15, 2015
3,996 days ago
CVE Severity & Scoring
Biztalk Server8 CVEs
13%
88%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network1 (12.5%)
Unknown7 (87.5%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (12.5%)
High0 (0.0%)
Unknown7 (87.5%)
User Interaction
None0 (0.0%)
Unknown7 (87.5%)
Required1 (12.5%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None1 (12.5%)
Unknown7 (87.5%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-0158HIGH The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Go | Apr 10, 2012 | 8.8 | 98 | YES | YES |
CVE-2009-1534HIGH Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visu | Aug 12, 2009 | 9.3 | 70 | NO | YES |
CVE-2007-0940HIGH Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows | May 8, 2007 | 9.3 | 64 | NO | NO |
CVE-2009-2496HIGH Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, O | Aug 12, 2009 | 9.3 | 39 | NO | NO |
CVE-2007-1201HIGH Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to Data | Mar 11, 2008 | 9.3 | 36 | NO | NO |
CVE-2003-0117HIGH Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary code via a certain request to th | May 12, 2003 | 7.5 | 32 | NO | YES |
CVE-2003-0118HIGH SQL injection vulnerability in the Document Tracking and Administration (DTA) website of Microsoft BizTalk Server 2000 and 2002 allows remote attackers to execute operating system | May 12, 2003 | 7.5 | 31 | NO | YES |
CVE-2015-2475MEDIUM Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 | Aug 15, 2015 | 4.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
1 CVE
12.5% of CVEs· 97th percentile
Metasploit
2 CVEs
25.0% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
4 CVEs
50.0% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Biztalk Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2013 | 1 | 4.3 | 14.6% | 0 | 0 |
| 2010 | 1 | 4.3 | 14.6% | 0 | 0 |
| 2004 | 1 | 9.3 | 75.7% | 0 | 0 |
| 2002 | 5 | 8.2 | 27.5% | 1 | 3 |
| 2000 | 2 | 7.7 | 10.2% | 0 | 1 |