CVE-2016-7250

Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

Information disclosure

Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services Information Disclosure Vulnerability."...

Privilege escalation

Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

Privilege escalation

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."...

Privilege escalation

Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."...

CVE-2016-7249

CVE-2016-7249 arises from a flaw in Microsoft SQL Server 2016 where the engine may miscast an unspecified pointer, enabling remote authenticated users to gain privileges via unknown vectors. The connected Nessus/OpenVAS/NASL data confirms this as a privileged-elevation issue in the SQL Server Eng...

CVE-2016-7254

CVE-2016-7254 affects Microsoft SQL Server 2012 SP2/SP3: the engine fails to properly cast an unspecified pointer, enabling remote authenticated privilege elevation via unknown vectors. The linked data also notes MS16-136 (KB3194725) as the security update mitigating multiple SQL Server vulnerabi...

CVE-2016-7252

Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services Information Disclosure Vulnerability."...

CVE-2016-7251

CVE-2016-7251 is a cross-site scripting (XSS) vulnerability in the Microsoft SQL Server 2016 Master Data Services (MDS) API. The issue arises from improper validation of a request parameter on the SQL Server MDS site, which could allow an attacker to inject client-side script or HTML. The vulnera...

CVE-2016-7249

Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7253

CVE-2016-7253 affects Microsoft SQL Server Agent privilege escalation in SQL Server 2012 SP2/3, 2014 SP1/2, and 2016. Root cause: the SQL Server Agent does not properly check ACLs on atxcore.dll, enabling remote authenticated users to gain privileges via unspecified vectors. Impact: elevation of ...

CVE-2016-7250

CVE-2016-7250 affects Microsoft SQL Server 2014 SP1/ SP2 and 2016. The vulnerability arises from an improper cast of an unspecified pointer in the SQL RDBMS Engine, enabling remote authenticated users to escalate privileges via unknown vectors. The issue is part of MS16-136 family of fixes; the r...

Microsoft SQL Server Master Data Services Cross-Site Scripting Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A cross-site scripting vulnerability exists in Microsoft SQL Server Master Data Services. The vulnerabilit...

Microsoft SQL Server RDBMS Engine Privilege Escalation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A privilege escalation vulnerability exists in the Microsoft SQL Server RDBMS engine. An attacker can...

Microsoft SQL RDBMS Engine Elevation of Privilege Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An elevation of privilege vulnerability exists in the 2016 version of Microsoft SQL Server that stems from...

Microsoft SQL Server Agent Privilege Elevation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An agent elevation of privilege vulnerability exists in Microsoft SQL Server. An attacker can exploit the...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or ...

KLA10901 Multiple vulnerabilities in Microsoft SQL Server

Multiple serious vulnerabilities have been found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to gain privileges or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper pointer casting handling can be exploited by remotely...