Sql Server
Vendor:
First CVE: Jun 29, 1998 · Active for 28 years
110
Total CVEs
More Total CVEs than 99% of tracked products
4.8
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 43% of tracked products
1.8%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Sql Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 29, 1998
28 years ago
Most Recent CVE
Jan 9, 2024
927 days ago
CVE Severity & Scoring
Sql Server110 CVEs
28%
68%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local15 (13.6%)
Network21 (19.1%)
Unknown74 (67.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low33 (30.0%)
High3 (2.7%)
Unknown74 (67.3%)
User Interaction
None22 (20.0%)
Unknown74 (67.3%)
Required14 (12.7%)
Privileges Required
Low16 (14.5%)
High0 (0.0%)
None20 (18.2%)
Unknown74 (67.3%)
Top CVEs
Signals from CVEs in this product scope (110 CVEs).
110 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-0618HIGH A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remo | Feb 11, 2020 | 8.8 | 99 | YES | YES |
CVE-2012-1856HIGH The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Serv | Aug 15, 2012 | 8.8 | 92 | YES | NO |
CVE-2008-5416HIGH Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Server 2005 SP2 and 9.00.1399.06 | Dec 10, 2008 | 9.0 | 86 | NO | YES |
CVE-2002-0649HIGH Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or ex | Aug 12, 2002 | 7.5 | 84 | NO | YES |
CVE-2002-1123HIGH Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long r | Sep 24, 2002 | 7.5 | 78 | NO | YES |
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the | May 30, 2000 | 2.1 | 71 | NO | YES |
CVE-2002-0186HIGH Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, ak | Jul 3, 2002 | 7.5 | 65 | NO | YES |
CVE-2008-3013HIGH gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, | Sep 11, 2008 | 9.3 | 62 | NO | YES |
CVE-2007-5348HIGH Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and | Sep 11, 2008 | 9.3 | 62 | NO | YES |
CVE-2002-0721HIGH Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and | Sep 5, 2002 | 10.0 | 61 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (110 CVEs).
CISA KEV
2 CVEs
1.8% of CVEs· 96th percentile
Metasploit
5 CVEs
4.5% of CVEs· 96th percentile
Nuclei
1 CVE
0.9% of CVEs· 96th percentile
ExploitDB
22 CVEs
20.0% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (110 CVEs).
Media Mentions
Signals from CVEs in this product scope (110 CVEs).
Top CNAs Publishing CVEs For Sql Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 7.0 | 36 | 6.5 | 17.5% | 0 | 9 |
| 6.5 | 4 | 5.5 | 7.6% | 0 | 0 |
| 6.0 | 1 | 7.5 | 5.9% | 0 | 0 |
| 2022 | 19 | 7.9 | 0.9% | 0 | 0 |
| 2019 | 21 | 7.8 | 1.1% | 0 | 0 |
| 2017 | 12 | 7.9 | 7.8% | 0 | 0 |
| 2016 | 17 | 8.0 | 15.6% | 1 | 1 |
| 2014 | 18 | 7.9 | 14.6% | 1 | 1 |
| 2012 | 16 | 7.5 | 15.1% | 1 | 1 |
| 2008_r2 | 1 | 7.8 | 0.7% | 0 | 0 |
| 2008 | 10 | 6.3 | 20.6% | 1 | 0 |
| 2005 | 21 | 7.9 | 25.6% | 1 | 4 |
| 2000 | 46 | 6.8 | 22.6% | 1 | 15 |