CVE-2016-7253

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."...

Microsoft SQL Server Master Data Services Cross-Site Scripting Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A cross-site scripting vulnerability exists in Microsoft SQL Server Master Data Services. The vulnerabilit...

Microsoft SQL RDBMS Engine Elevation of Privilege Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An elevation of privilege vulnerability exists in the 2016 version of Microsoft SQL Server that stems from...

Microsoft SQL Server RDBMS Engine Privilege Escalation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A privilege escalation vulnerability exists in the Microsoft SQL Server RDBMS engine. An attacker can...

Microsoft SQL Server Agent Privilege Elevation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An agent elevation of privilege vulnerability exists in Microsoft SQL Server. An attacker can exploit the...

KB3194720 - MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 GDR: November 8, 2016

KB3194720 - MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create...

KB3194725 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 2 CU: November 8, 2016

KB3194725 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 2 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create...

KB3194716 - MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016

KB3194716 - MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or to...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or...

SQL RDBMS Engine Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully exploited this vulnerability...

SQL RDBMS Engine Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully exploited this vulnerability...

MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 GDR: November 8, 2016

MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or...

KB3194719 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 2 GDR: November 8, 2016

KB3194719 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 2 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create...

KB3194717 - MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016

KB3194717 - MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or to...

KB3194724 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 CU: November 8, 2016

KB3194724 - MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create...

Microsoft SQL Server Analysis Services Information Disclosure Vulnerability

An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces permissions. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully exploited the...

MDS API XSS Vulnerability

A cross-site scripting vulnerability exists in SQL Server MDS that could allow an attacker to inject a client-side script into the user's browser instance. The vulnerability is caused when the SQL Server MDS does not properly validate a request parameter on the SQL Server site. The script could...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 CU: November 8, 2016

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or ...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or ...

Microsoft SQL Server Agent Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft SQL Server Engine when SQL Server Agent incorrectly checks ACLs on atxcore.dll. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully...