Microsoft
Microsoft XML Core Services: vulnerabilities and CVEs
Microsoft XML Core Services has 19 published vulnerabilities, 0 of them in the last 12 months. 0 are rated critical and 2 are listed by CISA as actively exploited.
CVEs19
Last 12 months0
Critical0
Actively exploited2
All vulnerabilities in the catalogue →⭐ Follow this technology
🔴 Actively exploited (CISA KEV)
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2012-1889 | High (8.8) | 84% | ⚠ Active exploitation | Jun 13, 2012 | Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. |
| CVE-2017-0022 | Medium (6.5) | 18% | ⚠ Active exploitation | Mar 17, 2017 | Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows… |
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2017-0022 | Medium (6.5) | 18% | ⚠ Active exploitation | Mar 17, 2017 | Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows… |
| CVE-2016-0147 | High (8.8) | 16% | — | Apr 12, 2016 | Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." |
| CVE-2015-2471 | Medium (4.3) | 16% | — | Aug 15, 2015 | Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka… |
| CVE-2015-2440 | Medium (4.3) | 19% | — | Aug 15, 2015 | Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure Vulnerability." |
| CVE-2015-2434 | Medium (4.3) | 16% | — | Aug 15, 2015 | Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML… |
| CVE-2015-1646 | Medium (4.3) | 17% | — | Apr 14, 2015 | Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability." |
| CVE-2014-1816 | Medium (4.3) | 14% | — | Jun 11, 2014 | Microsoft XML Core Services (aka MSXML) 3.0 and 6.0 does not properly restrict the information transmitted by Internet Explorer during a download action, which allows remote attackers to discover (1) full pathnames on… |
| CVE-2013-0007 | High (9.3) | 32% | — | Jan 9, 2013 | Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability." |
| CVE-2013-0006 | High (8.8) | 28% | — | Jan 9, 2013 | Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability." |
| CVE-2012-1889 | High (8.8) | 84% | ⚠ Active exploitation | Jun 13, 2012 | Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. |
| CVE-2010-2561 | High (9.3) | 25% | — | Aug 11, 2010 | Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted response, aka… |
| CVE-2009-0419 | Medium (5) | 15% | — | Feb 4, 2009 | Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which… |
| CVE-2008-4033 | Medium (4.3) | 28% | — | Nov 12, 2008 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from… |
| CVE-2007-2223 | High (9.3) | 49% | — | Aug 14, 2007 | Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a… |
| CVE-2007-0099 | High (9.3) | 25% | — | Jan 8, 2007 | Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application… |
| CVE-2006-5745 | High (7.6) | 77% | — | Nov 6, 2006 | Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML Core Services 4.0 on Windows, when accessed by Internet Explorer, allows remote attackers to… |
| CVE-2006-4685 | Low (2.6) | 21% | — | Oct 10, 2006 | The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other… |
| CVE-2006-4686 | High (7.5) | 30% | — | Oct 10, 2006 | Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted… |
| CVE-2002-0057 | Medium (5) | 19% | — | Mar 8, 2002 | XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source. |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.