Windows Server 2008 vulnerabilities

175 known vulnerabilities in Windows Server 2008 from Microsoft. 159 are rated high or critical, and 148 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Microsoft Windows Code Injection Exploited

  CVE-2014-6352Oct 22, 2014MicrosoftEPSS 77.5%

  Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the

• 8.8 High severity

  Microsoft Windows Remote Code Execution Exploited

  CVE-2014-4148Oct 15, 2014MicrosoftEPSS 59.9%

  win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to ex

• 9.3 High severity

  Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Exploited

  CVE-2014-4114Oct 15, 2014MicrosoftEPSS 81.6%

  Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object in an Office document

• 7.2 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2014-4113Oct 15, 2014MicrosoftEPSS 86.6%

  win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain pr

• 9.0 High severity

  Microsoft Windows Group Policy Preferences Password Privilege Escalation Exploited

  CVE-2014-1812May 14, 2014MicrosoftEPSS 65.1%

  The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated

• 8.8 High severity

  Microsoft WinVerifyTrust function Remote Code Execution Exploited

  CVE-2013-3900Dec 11, 2013MicrosoftEPSS 44.6%

  Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windo

• 8.8 High severity

  Microsoft Windows Out-of-Bounds Write Exploited

  CVE-2013-3918Nov 12, 2013MicrosoftEPSS 73.9%

  The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, an

• 7.8 High severity

  Microsoft Graphics Component Memory Corruption Exploited

  CVE-2013-3906Nov 6, 2013MicrosoftEPSS 84.9%

  GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF ima

• 7.8 High severity

  Microsoft Win32k Privilege Escalation Exploited

  CVE-2013-3660May 24, 2013MicrosoftEPSS 39.3%

  The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not proper

• 7.8 High severity

  Microsoft Windows Authenticode Signature Verification Remote Code Execution Exploited

  CVE-2012-0151Apr 10, 2012MicrosoftEPSS 87.7%

  The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the dig

• 8.8 High severity

  Microsoft Windows Remote Code Execution Exploited

  CVE-2011-3402Nov 4, 2011MicrosoftEPSS 78.3%

  Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows r

• 7.8 High severity

  Microsoft Windows Kernel Stack-Based Buffer Overflow Exploited

  CVE-2010-4398Dec 6, 2010MicrosoftEPSS 8.66%

  Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges

• 9.3 High severity

  Microsoft Windows Remote Code Execution Exploited

  CVE-2010-2568Jul 22, 2010MicrosoftEPSS 89.6%

  Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handle

• 7.8 High severity

  Microsoft Windows Improper Input Validation Exploited

  CVE-2009-1123Jun 10, 2009MicrosoftEPSS 4.88%

  The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, ak

• 10.0 High severity

  Microsoft Windows Buffer Overflow Exploited

  CVE-2008-4250Oct 23, 2008MicrosoftEPSS 98.8%

  The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canoni