CVE-2016-7250

CVE-2016-7250 affects Microsoft SQL Server 2014 SP1/ SP2 and 2016. The vulnerability arises from an improper cast of an unspecified pointer in the SQL RDBMS Engine, enabling remote authenticated users to escalate privileges via unknown vectors. The issue is part of MS16-136 family of fixes; the r...

CVE-2016-7252

Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services Information Disclosure Vulnerability."...

CVE-2016-7254

Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7252

CVE-2016-7252 is tied to Microsoft SQL Server 2016 Analysis Services Information Disclosure via improper FILESTREAM path handling. The vulnerability allows an authenticated, remote attacker to disclose sensitive data by abusing the FILESTREAM path validation vulnerability (root cause: improper va...

CVE-2016-7249

CVE-2016-7249 arises from a flaw in Microsoft SQL Server 2016 where the engine may miscast an unspecified pointer, enabling remote authenticated users to gain privileges via unknown vectors. The connected Nessus/OpenVAS/NASL data confirms this as a privileged-elevation issue in the SQL Server Eng...

CVE-2016-7249

Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7251

CVE-2016-7251 is a cross-site scripting (XSS) vulnerability in the Microsoft SQL Server 2016 Master Data Services (MDS) API. The issue arises from improper validation of a request parameter on the SQL Server MDS site, which could allow an attacker to inject client-side script or HTML. The vulnera...

CVE-2016-7253

CVE-2016-7253 affects Microsoft SQL Server Agent privilege escalation in SQL Server 2012 SP2/3, 2014 SP1/2, and 2016. Root cause: the SQL Server Agent does not properly check ACLs on atxcore.dll, enabling remote authenticated users to gain privileges via unspecified vectors. Impact: elevation of ...

CVE-2016-7254: Undefined Security Weakness

Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7252: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services Information Disclosure Vulnerability."...

CVE-2016-7249: Undefined Security Weakness

Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7253: Undefined Security Weakness

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."...

CVE-2016-7250: Undefined Security Weakness

Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."...

CVE-2016-7251: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."...

Microsoft SQL Server Agent Privilege Elevation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An agent elevation of privilege vulnerability exists in Microsoft SQL Server. An attacker can exploit the...

Microsoft SQL Server Master Data Services Cross-Site Scripting Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A cross-site scripting vulnerability exists in Microsoft SQL Server Master Data Services. The vulnerabilit...

Microsoft SQL RDBMS Engine Elevation of Privilege Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An elevation of privilege vulnerability exists in the 2016 version of Microsoft SQL Server that stems from...

Microsoft SQL Server RDBMS Engine Privilege Escalation Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A privilege escalation vulnerability exists in the Microsoft SQL Server RDBMS engine. An attacker can...

KB3194716 - MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016

KB3194716 - MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or to...

KB3194717 - MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016

KB3194717 - MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016 Summary This update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker to gain elevated privileges that might be used to create accounts, or to...