CVSS: 7.5EPSS: 96%CPEs: 4EXPL: 2CVE-2002-1123 – Microsoft SQL Server - Hello Overflow (MS02-056)
https://notcve.org/view.php?id=CVE-2002-1123
Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow. Desbordamiento de búfer en Microsof SQL Server permite a atacantes remotos ejecutar código arbitrario mediante una petición larga al puerto TCP 1433, también conocido como desbordamiento "Hello". • https://www.exploit-db.com/exploits/16398 https://www.exploit-db.com/exploits/21693 http://marc.info/?l=bugtraq&m=102873609025020&w=2 http://online.securityfocus.com/archive/1/286220 http://www.ciac.org/ciac/bulletins/n-003.shtml http://www.iss.net/security_center/static/9788.php http://www.securityfocus.com/bid/5411 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-056 •
CVSS: 10.0EPSS: 6%CPEs: 10EXPL: 1CVE-2002-0721 – Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation
https://notcve.org/view.php?id=CVE-2002-0721
Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could allow unprivileged users, and possibly remote attackers, to run stored procedures with administrator privileges via (1) xp_execresultset, (2) xp_printstatements, or (3) xp_displayparamstmt. Microsoft SQL Server 7.0 y 2000 se instala con permisos débiles para ciertos procedimientos almacenados (stored procedures) extendidos que están asociados con funciones de ayuda, lo que podría permitir a usuairos sin privilegios, y posiblemente atacantes remotos, ejecutar procedimentos almacenados con privilegios de administrador. • https://www.exploit-db.com/exploits/21718 http://archives.neohapsis.com/archives/ntbugtraq/2002-q3/0087.html http://marc.info/?l=bugtraq&m=102950473002959&w=2 http://marc.info/?l=ntbugtraq&m=102950792606475&w=2 http://www.kb.cert.org/vuls/id/399531 http://www.kb.cert.org/vuls/id/818939 http://www.kb.cert.org/vuls/id/939675 http://www.ngssoftware.com/advisories/mssql-esppu.txt https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-043 •
CVSS: 10.0EPSS: 95%CPEs: 10EXPL: 2CVE-2000-1209 – Microsoft SQL Server - Payload Execution
https://notcve.org/view.php?id=CVE-2000-1209
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida. • https://www.exploit-db.com/exploits/16395 https://www.exploit-db.com/exploits/16394 http://marc.info/?l=bugtraq&m=96333895000350&w=2 http://marc.info/?l=bugtraq&m=96593218804850&w=2 http://marc.info/?l=bugtraq&m=96644570412692&w=2 http://online.securityfocus.com/archive/1/273639 http://security-archive.merton.ox.ac.uk/bugtraq-200008/0233.html http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ313418 http://support.microsoft.com/default.aspx? •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2002-0644 – Microsoft SQL Server 2000 - Database Consistency Checkers Buffer Overflow
https://notcve.org/view.php?id=CVE-2002-0644
Buffer overflow in several Database Consistency Checkers (DBCCs) for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows members of the db_owner and db_ddladmin roles to execute arbitrary code. Desbordamiento de buffer en varios Comprobadores de Consistencia de Base de Datos (Database Consistency Checkers - DBCCs) en Microsoft SQL Server 2000 y Microsoft Desktop Engine (MSDE) 2000 permite a miembros de los grupos db_owner y db_ddladmin ejecutar código arbitrario. • https://www.exploit-db.com/exploits/21650 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-038 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2002-0645
https://notcve.org/view.php?id=CVE-2002-0645
SQL injection vulnerability in stored procedures for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 may allow authenticated users to execute arbitrary commands. Vulnerabilidad de inyección de SQL en procedimientos almacenados en Microsoft SQL Server 2000 y Microsoft Desktop engine (MSDE) 2000 puede que permita a usuarios autenticados ejecutar comandos arbitrarios. • https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-038 •