CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft SQL Server Remote Code Execution Vulnerability Advisory (CVE-2019-1068)
[Affected Scope] Microsoft SQL Server 2014, 2016, and 2017
[Impact] An authenticated attacker can execute arbitrary code under the security context of the SQL Server Database Engine service account, potentially leading to full system compromise
[Mitigation] Immediately apply the latest Cumulative Updates (CU) or Service Pack (SP) security patches provided by Microsoft
Microsoft MSCOMCTL.OCX TabStrip ActiveX Control Remote Code Execution Vulnerability (CVE-2012-1856)
[Affected Scope] Systems running Microsoft Office 2003/2007/2010, SQL Server 2000/2005/2008, or Visual Basic 6.0 Runtime utilizing MSCOMCTL.OCX
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by corrupting system memory via crafted documents or web pages
[Mitigation] Apply the official Microsoft MS12-060 security update or configure ActiveX Kill Bits for the vulnerable TabStrip control
Microsoft Office and SQL Server MSCOMCTL.OCX ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158)
[Affected Scope] Microsoft Office 2003/2007/2010, SQL Server 2000/2005/2008, and Visual Basic 6.0 Runtime utilizing the MSCOMCTL.OCX library
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by enticing them to open a crafted Office document, RTF file, or malicious website
[Mitigation] Apply the official Microsoft MS12-027 security patch immediately, or configure registry Kill-Bits to disable the vulnerable ActiveX controls