CVE-2013-3878: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the LRPC client in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges by operating an LRPC server that sends a crafted LPC port message, aka "LRPC Client Buffer Overrun Vulnerability."...

CVE-2013-3899: Improper Input Validation

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate addresses, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Vulnerability."...

Microsoft Windows DNS Server远程拒绝服务漏洞(MS12-017)

BUGTRAQ ID: 52374 CVE ID: CVE-2012-0006 Windows DNS Server是微软公司推出的域名系统或者域名服务，域名系统为Internet上的主机分配域名地址和IP地址。 Windows DNS Server在处理某些lookup查询时，在实现上存在远程拒绝服务漏洞，远程攻击者可利用此漏洞造成DNS服务器停止响应，拒绝服务合法用户。 0 Microsoft Server 2008 Microsoft Server 2003 厂商补丁： Microsoft ---------...

CVE-2011-0039: Improper Authentication

The Local Security Authority Subsystem Service LSASS in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."...

CVE-2010-3963: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the Routing and Remote Access NDProxy component in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, related to the Routing and Remote Access service RRAS and improper copying from user mode to th...

CVE-2010-2741: Undefined Security Weakness

The OpenType Font OTF format driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 performs an incorrect integer calculation during font processing, which allows local users to gain privileges via a crafted application, aka "OpenType Font Validation Vulnerability."...

CVE-2010-3144: Undefined Security Weakness

Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse smmscrpt.dll file in the current working directory, as demonstrated by a directory that contains an ISP or...

CVE-2010-0024: Improper Input Validation

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2003 SP2, does not properly parse MX records, which allows remote DNS servers to cause a denial of service service outage via a crafted response to a DNS MX...

CVE-2010-0025: Exposure of Sensitive Information to an Unauthorized Actor

The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of...

CVE-2010-0016: Improper Input Validation

The SMB client implementation in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate response fields, which allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code via a crafted response, aka "SMB Client Pool Corruption...

CVE-2009-4312: Improper Control of Generation of Code

Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Dave Lenoe of Adobe...

Input validation

The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate user-mode pointers in unspecified error conditions, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Pointe...

Microsoft RPC Marshalling Engine Remote Code Execution Vulnerability

Description Microsoft Windows RPC Marshalling Engine is prone to a remote code-execution vulnerability. An attacker can exploit this issue by sending a specially crafted RPC request to an affected computer. Successfully exploiting this issue will allow the attacker to execute arbitrary code with...

CVE-2009-0079: Undefined Security Weakness

The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that 1 all run under the NetworkService account or 2 all run under the LocalService account, which allows local users to gain privileges by...

CVE-2009-0087: Undefined Security Weakness

Unspecified vulnerability in the Word 6 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and the Word 6 text converter in Microsoft Office Word 2000 SP3 and 2002 SP3; allows remote attackers to execute arbitrary code via a crafted Word 6 file...

CVE-2008-1440: Improper Validation of Specified Quantity in Input

Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multicast PGM packets, which allows remote attackers to cause a denial of service infinite loop and system hang via a crafted PGM packet, aka the "PGM Invalid...

CVE-2008-1436: Undefined Security Weakness

Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the 1 NetworkService and 2 LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service...

CVE-2007-2374: Undefined Security Weakness

Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is from a reliable sour...

CVE-2006-5585: Undefined Security Weakness

The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."...

CVE-2006-4689: Undefined Security Weakness

Unspecified vulnerability in the driver for the Client Service for NetWare CSNW in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to cause a denial of service hang and reboot via has unknown attack vectors, aka "NetWare Driver Denial of Service Vulnerability...