Xml Core Services

Vendor:

First CVE: Mar 8, 2002 · Active for 24 years

19

Total CVEs

More Total CVEs than 93% of tracked products

1.6

Avg CVEs / Year

Higher CVE frequency than 59% of tracked products

6.5

Avg CVSS

Higher Avg CVSS than 31% of tracked products

10.5%

KEV Rate

Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Xml Core Services over time

Volume of CVEsAvg CVSS Base Score

First CVE

Mar 8, 2002

24 years ago

Most Recent CVE

Mar 17, 2017

3,417 days ago

CVE Severity & Scoring

Xml Core Services19 CVEs

47%

All CVEs352,427 CVEs

45%

40%

11%

LowMediumHigh

Attack Vector

Local0 (0.0%)

Network4 (21.1%)

Unknown15 (78.9%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low4 (21.1%)

High0 (0.0%)

Unknown15 (78.9%)

User Interaction

None0 (0.0%)

Unknown15 (78.9%)

Required4 (21.1%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None4 (21.1%)

Unknown15 (78.9%)

Top CVEs

Signals from CVEs in this product scope (19 CVEs).

19 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2012-1889HIGH Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (me	Jun 13, 2012	8.8	97	YES	YES
CVE-2006-5745HIGH Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Expl	Nov 6, 2006	7.6	77	NO	YES
CVE-2017-0022MEDIUM Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and	Mar 17, 2017	6.5	68	YES	NO
CVE-2007-2223HIGH Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which cau	Aug 14, 2007	9.3	66	NO	YES
CVE-2010-2561HIGH Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory co	Aug 11, 2010	9.3	51	NO	YES
CVE-2013-0007HIGH Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "	Jan 9, 2013	9.3	46	NO	NO
CVE-2013-0006HIGH Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "	Jan 9, 2013	8.8	42	NO	NO
CVE-2007-0099HIGH Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or	Jan 8, 2007	9.3	34	NO	NO
CVE-2008-4033MEDIUM Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attacke	Nov 12, 2008	4.3	33	NO	YES
CVE-2006-4686HIGH Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to	Oct 10, 2006	7.5	32	NO	NO

View all 19 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (19 CVEs).

CISA KEV

2 CVEs

10.5% of CVEs· 97th percentile

Metasploit

2 CVEs

10.5% of CVEs· 97th percentile

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

5 CVEs

26.3% of CVEs· 90th percentile

Social Chatter

Signals from CVEs in this product scope (19 CVEs).

Media Mentions

Signals from CVEs in this product scope (19 CVEs).

Top CNAs Publishing CVEs For Xml Core Services

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	KEV	Exploits
6.0	10	6.8	31.4%	1	3
5.0	8	6.7	33.7%	1	3
4.0	9	7.5	39.3%	1	4
3.0	17	6.5	26.6%	2	4
2.6	1	5.0	19.2%	0	0