CVE-2000-0199
HighExploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the 'Always prompt for login name and password' option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.
Risk Assessment
Weak encryption may lead to unauthorized access to data, posing a serious security threat to the organization.
Recommendation
It is recommended to enable the 'Always prompt for login name and password' option and consider upgrading to a newer version of SQL Server with better security mechanisms.
Other vulnerabilities in Microsoft SQL Server 7.0
See all- CVE-2026-94512High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. The vulnerability can be exploited remotely, posing a serious threat to system integrity.
- CVE-2026-88088High
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability can be exploited to gain higher privileges on the system.
- CVE-2026-88083High
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. The vulnerability can be exploited remotely without authentication, posing a serious threat.
- CVE-2026-88082High
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability can be exploited to gain higher privileges on the system.
- CVE-2026-88081High
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. The vulnerability can be exploited to remotely read data.
- CVE-2026-85919High
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability can be exploited to gain higher privileges on the system.
- CVE-2016-7249High
Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, allowing remote authenticated users to gain privileges via unknown vectors.
- CVE-2026-67643Critical
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-67631Critical
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2019-1068HighActively exploited
A remote code execution vulnerability exists in Microsoft SQL Server due to improper handling of internal functions. An attacker could exploit it to execute arbitrary code on the server.
Original NVD description (English source)
When a new SQL Server is registered in Enterprise Manager for Microsoft SQL Server 7.0 and the "Always prompt for login name and password" option is not set, then the Enterprise Manager uses weak encryption to store the login ID and password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS