Search
Find a vulnerability
Search criteria
8 vulnerabilities found for Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) by Microsoft
CVE-2022-29143 (GCVE-0-2022-29143)
Vulnerability from nvd – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI
EPSS
VEX
Title
Microsoft SQL Server Remote Code Execution Vulnerability
Summary
Microsoft SQL Server Remote Code Execution Vulnerability
Severity
CWE
- Remote Code Execution
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
10 products
Date Public
2022-06-14 07:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:59.417Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29143"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.2042.3",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems",
"32-bit Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "12.0.6169.19",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.5108.50",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "12.0.6439.10",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.0.2095.3",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (CU 16)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.0.4236.7",
"status": "affected",
"version": "15.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems"
],
"product": "Microsoft SQL Server 2017 (CU 29)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.3445.2",
"status": "affected",
"version": "14.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 2 (CU 17)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.5893.48",
"status": "affected",
"version": "13.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.6419.1",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.7016.1",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*",
"versionEndExcluding": "14.0.2042.3",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "12.0.6169.19",
"versionStartIncluding": "12.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp2:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.5108.50",
"versionStartIncluding": "13.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*",
"versionEndExcluding": "12.0.6439.10",
"versionStartIncluding": "12.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "15.0.2095.3",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "15.0.4236.7",
"versionStartIncluding": "15.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*",
"versionEndExcluding": "14.0.3445.2",
"versionStartIncluding": "14.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp2:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.5893.48",
"versionStartIncluding": "13.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.6419.1",
"versionStartIncluding": "13.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.7016.1",
"versionStartIncluding": "13.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-06-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft SQL Server Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:03:12.592Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft SQL Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143"
}
],
"title": "Microsoft SQL Server Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-29143",
"datePublished": "2022-06-15T21:51:15.000Z",
"dateReserved": "2022-04-12T00:00:00.000Z",
"dateUpdated": "2025-01-02T19:03:12.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-1636 (GCVE-0-2021-1636)
Vulnerability from nvd – Published: 2021-01-12 19:41 – Updated: 2024-10-08 16:17
VLAI
EPSS
VEX
Title
Microsoft SQL Elevation of Privilege Vulnerability
Summary
Microsoft SQL Elevation of Privilege Vulnerability
Severity
CWE
- Elevation of Privilege
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft SQL Server 2012 Service Pack 4 (QFE) |
Affected:
11.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:* |
|
| Microsoft | Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) |
Affected:
11.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:* |
|
| Microsoft | Microsoft SQL Server 2017 (GDR) |
Affected:
14.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 (GDR) |
Affected:
12.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:* cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:* |
|
| Microsoft | Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) |
Affected:
13.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 (CU 4) |
Affected:
12.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:* cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2017 (CU 22) |
Affected:
14.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2016 Service Pack 2 (CU 15) |
Affected:
13.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2019 (CU 8) |
Affected:
16.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2019 (GDR) |
Affected:
15.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:* |
Date Public
2021-01-12 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:18:10.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1636"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"
],
"platforms": [
"32-bit Systems"
],
"product": "Microsoft SQL Server 2012 Service Pack 4 (QFE)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*",
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*"
],
"platforms": [
"x64-based Systems",
"32-bit Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*",
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*"
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (CU 22)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 2 (CU 15)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (CU 8)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-12T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft SQL Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T16:17:34.725Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft SQL Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1636"
}
],
"title": "Microsoft SQL Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-1636",
"datePublished": "2021-01-12T19:41:55.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-10-08T16:17:34.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-0618 (GCVE-0-2020-0618)
Vulnerability from nvd – Published: 2020-02-11 21:22 – Updated: 2026-08-15 03:55Summary
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
Severity
9.8 (Critical)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-20 00:00 UTC
CWE
- Remote Code Execution
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
| http://packetstormsecurity.com/files/156707/SQL-S… | x_refsource_MISC |
| http://packetstormsecurity.com/files/159216/Micro… | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft SQL Server |
Affected:
2012 for 32-bit Systems Service Pack 4 (QFE)
Affected: 2012 for x64-based Systems Service Pack 4 (QFE) Affected: 2016 for x64-based Systems Service Pack 2 (CU) |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:11:04.564Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"dateAdded": "2024-09-18",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618"
},
"type": "kev"
}
},
{
"other": {
"content": {
"id": "CVE-2020-0618",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T03:55:30.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft SQL Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2012 for 32-bit Systems Service Pack 4 (QFE)"
},
{
"status": "affected",
"version": "2012 for x64-based Systems Service Pack 4 (QFE)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka \u0027Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-17T22:06:13.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0618",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft SQL Server",
"version": {
"version_data": [
{
"version_value": "2012 for 32-bit Systems Service Pack 4 (QFE)"
},
{
"version_value": "2012 for x64-based Systems Service Pack 4 (QFE)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka \u0027Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"name": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"name": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-0618",
"datePublished": "2020-02-11T21:22:45.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2026-08-15T03:55:30.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-1068 (GCVE-0-2019-1068)
Vulnerability from nvd – Published: 2019-07-15 18:56 – Updated: 2026-08-27 03:57Summary
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Severity
8.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- Remote Code Execution
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
10 products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:06:31.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2019-1068",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:57:25.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-26T00:00:00.000Z",
"value": "CVE-2019-1068 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2014 Service Pack 2 for 32-bit Systems (CU)"
},
{
"status": "affected",
"version": "2014 Service Pack 2 for x64-based Systems (CU)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 1 (CU)"
},
{
"status": "affected",
"version": "2017 for x64-based Systems (CU)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2017 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka \u0027Microsoft SQL Server Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-15T18:56:20.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-1068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server",
"version": {
"version_data": [
{
"version_value": "2014 Service Pack 2 for 32-bit Systems (CU)"
},
{
"version_value": "2014 Service Pack 2 for x64-based Systems (CU)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 1 (CU)"
},
{
"version_value": "2017 for x64-based Systems (CU)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2017 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka \u0027Microsoft SQL Server Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2019-1068",
"datePublished": "2019-07-15T18:56:20.000Z",
"dateReserved": "2018-11-26T00:00:00.000Z",
"dateUpdated": "2026-08-27T03:57:25.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-29143 (GCVE-0-2022-29143)
Vulnerability from cvelistv5 – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:03
VLAI
EPSS
VEX
Title
Microsoft SQL Server Remote Code Execution Vulnerability
Summary
Microsoft SQL Server Remote Code Execution Vulnerability
Severity
CWE
- Remote Code Execution
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
10 products
Date Public
2022-06-14 07:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:59.417Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29143"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.2042.3",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems",
"32-bit Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "12.0.6169.19",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.5108.50",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "12.0.6439.10",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.0.2095.3",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (CU 16)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.0.4236.7",
"status": "affected",
"version": "15.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems"
],
"product": "Microsoft SQL Server 2017 (CU 29)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.3445.2",
"status": "affected",
"version": "14.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 2 (CU 17)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.5893.48",
"status": "affected",
"version": "13.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.6419.1",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "13.0.7016.1",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*",
"versionEndExcluding": "14.0.2042.3",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "12.0.6169.19",
"versionStartIncluding": "12.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp2:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.5108.50",
"versionStartIncluding": "13.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*",
"versionEndExcluding": "12.0.6439.10",
"versionStartIncluding": "12.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "15.0.2095.3",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "15.0.4236.7",
"versionStartIncluding": "15.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:-:*:*:*:*:x64:*",
"versionEndExcluding": "14.0.3445.2",
"versionStartIncluding": "14.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp2:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.5893.48",
"versionStartIncluding": "13.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.6419.1",
"versionStartIncluding": "13.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server:*:sp3:*:*:*:*:x64:*",
"versionEndExcluding": "13.0.7016.1",
"versionStartIncluding": "13.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-06-14T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft SQL Server Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:03:12.592Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft SQL Server Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143"
}
],
"title": "Microsoft SQL Server Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-29143",
"datePublished": "2022-06-15T21:51:15.000Z",
"dateReserved": "2022-04-12T00:00:00.000Z",
"dateUpdated": "2025-01-02T19:03:12.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-1636 (GCVE-0-2021-1636)
Vulnerability from cvelistv5 – Published: 2021-01-12 19:41 – Updated: 2024-10-08 16:17
VLAI
EPSS
VEX
Title
Microsoft SQL Elevation of Privilege Vulnerability
Summary
Microsoft SQL Elevation of Privilege Vulnerability
Severity
CWE
- Elevation of Privilege
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft SQL Server 2012 Service Pack 4 (QFE) |
Affected:
11.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:* |
|
| Microsoft | Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) |
Affected:
11.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:* |
|
| Microsoft | Microsoft SQL Server 2017 (GDR) |
Affected:
14.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 (GDR) |
Affected:
12.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:* cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:* |
|
| Microsoft | Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) |
Affected:
13.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 (CU 4) |
Affected:
12.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:* cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2017 (CU 22) |
Affected:
14.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2016 Service Pack 2 (CU 15) |
Affected:
13.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2019 (CU 8) |
Affected:
16.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:* |
|
| Microsoft | Microsoft SQL Server 2019 (GDR) |
Affected:
15.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:* |
Date Public
2021-01-12 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:18:10.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1636"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"
],
"platforms": [
"32-bit Systems"
],
"product": "Microsoft SQL Server 2012 Service Pack 4 (QFE)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2012:sp4:*:*:*:*:*:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*",
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*"
],
"platforms": [
"x64-based Systems",
"32-bit Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x86:*",
"cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:x64:*"
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft SQL Server 2014 Service Pack 3 (CU 4)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "12.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2017:-:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2017 (CU 22)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2016 Service Pack 2 (CU 15)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "13.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (CU 8)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:x64:*"
],
"platforms": [
"x64-based Systems"
],
"product": "Microsoft SQL Server 2019 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-01-12T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft SQL Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of Privilege",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T16:17:34.725Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft SQL Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1636"
}
],
"title": "Microsoft SQL Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-1636",
"datePublished": "2021-01-12T19:41:55.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-10-08T16:17:34.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-0618 (GCVE-0-2020-0618)
Vulnerability from cvelistv5 – Published: 2020-02-11 21:22 – Updated: 2026-08-15 03:55Summary
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
Severity
9.8 (Critical)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-20 00:00 UTC
CWE
- Remote Code Execution
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
| http://packetstormsecurity.com/files/156707/SQL-S… | x_refsource_MISC |
| http://packetstormsecurity.com/files/159216/Micro… | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft SQL Server |
Affected:
2012 for 32-bit Systems Service Pack 4 (QFE)
Affected: 2012 for x64-based Systems Service Pack 4 (QFE) Affected: 2016 for x64-based Systems Service Pack 2 (CU) |
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) |
Affected:
unspecified
|
|
| Microsoft | Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:11:04.564Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"dateAdded": "2024-09-18",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618"
},
"type": "kev"
}
},
{
"other": {
"content": {
"id": "CVE-2020-0618",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T03:55:30.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0618"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft SQL Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2012 for 32-bit Systems Service Pack 4 (QFE)"
},
{
"status": "affected",
"version": "2012 for x64-based Systems Service Pack 4 (QFE)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka \u0027Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-17T22:06:13.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0618",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft SQL Server",
"version": {
"version_data": [
{
"version_value": "2012 for 32-bit Systems Service Pack 4 (QFE)"
},
{
"version_value": "2012 for x64-based Systems Service Pack 4 (QFE)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka \u0027Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618"
},
{
"name": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/156707/SQL-Server-Reporting-Services-SSRS-ViewState-Deserialization.html"
},
{
"name": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/159216/Microsoft-SQL-Server-Reporting-Services-2016-Remote-Code-Execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-0618",
"datePublished": "2020-02-11T21:22:45.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2026-08-15T03:55:30.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-1068 (GCVE-0-2019-1068)
Vulnerability from cvelistv5 – Published: 2019-07-15 18:56 – Updated: 2026-08-27 03:57Summary
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Severity
8.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- Remote Code Execution
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
10 products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:06:31.612Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2019-1068",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:57:25.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-26T00:00:00.000Z",
"value": "CVE-2019-1068 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "2014 Service Pack 2 for 32-bit Systems (CU)"
},
{
"status": "affected",
"version": "2014 Service Pack 2 for x64-based Systems (CU)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 1 (CU)"
},
{
"status": "affected",
"version": "2017 for x64-based Systems (CU)"
},
{
"status": "affected",
"version": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2017 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka \u0027Microsoft SQL Server Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-15T18:56:20.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2019-1068",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server",
"version": {
"version_data": [
{
"version_value": "2014 Service Pack 2 for 32-bit Systems (CU)"
},
{
"version_value": "2014 Service Pack 2 for x64-based Systems (CU)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 1 (CU)"
},
{
"version_value": "2017 for x64-based Systems (CU)"
},
{
"version_value": "2016 for x64-based Systems Service Pack 2 (CU)"
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2017 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka \u0027Microsoft SQL Server Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2019-1068",
"datePublished": "2019-07-15T18:56:20.000Z",
"dateReserved": "2018-11-26T00:00:00.000Z",
"dateUpdated": "2026-08-27T03:57:25.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}