CVE-2007-1205

CVE-2007-1205 is a remote code execution vulnerability in Microsoft Agent (msagent\agentsvr.exe) on Windows 2000 SP4, Windows XP SP2, and Windows Server 2003 SP1/SP2. The flaw arises from how Microsoft Agent handles certain specially crafted URLs, leading to memory corruption and arbitrary code e...

CVE-2008-1086

The CVE-2008-1086 issue concerns the hxvz.dll ActiveX control (HxTocCtrl) used by Microsoft Help 2.5 and exposed in Internet Explorer on Windows XP SP2, Server 2003 SP1/SP2, Vista SP1, and Server 2008. The vulnerability is a memory corruption flaw triggered by malformed arguments to the ActiveX c...

CVE-2008-2252

CVE-2008-2252 maps to a Windows kernel memory corruption vulnerability (Windows kernel memory input validation). The Affected Software includes Windows 2000 SP4, XP SP2/SP3, Server 2003 SP1/SP2, Vista (Gold/SP1), and Server 2008. Root cause: the kernel improperly validates input passed from user ...

CVE-2008-3648

CVE-2008-3648 affects nslookup.exe in Microsoft Windows XP SP2. The provided OpenVAS entries describe a remote code execution (RCE) vulnerability in Windows XP SP2, triggered by how nslookup.exe handles DNS operations (e.g., a DNS zone transfer). The NVD entry corroborates an RCE scenario with us...

CVE-2009-4309

CVE-2009-4309 describes a heap-based buffer overflow in the Intel Indeo41 codec used by Windows Media Player, affecting Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2. The flaw arises from missing bounds checking on a size field in the IV41/movi record of an IV41 stream, permitting remote atta...

CVE-2009-4313

The CVE-2009-4313 issue affects the Microsoft Windows Indeo32 codec (ir32_32.dll 3.24.15.3) in Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2. The underlying flaw is malformed data in a stream within media files (e.g., AVI), which can lead to heap corruption and allow remote code execution or ...

CVE-2010-1098

The CVE-2010-1098 entry describes a denial-of-service flaw in the ANI parser found in Microsoft Windows prior to 7 on x86, used by Internet Explorer and other apps. A crafted biClrUsed value in the BITMAPINFO header of a .ANI file can cause memory and CPU exhaustion, leading to a DoS condition. A...

CVE-2010-1891

CVE-2010-1891 affects the Windows Client/Server Runtime Subsystem (CSRSS) in the Win32 subsystem on Windows XP SP2/SP3 and Windows Server 2003 SP2. The vulnerability stems from improper memory allocation for transactions when Chinese, Japanese, or Korean locales are enabled, allowing local users ...

CVE-2011-0089

CVE-2011-0089 affects Windows kernel-mode driver win32k.sys across multiple OS versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7). The issue is improper validation of user-mode data by the Win32k subsystem, enabling local users to gain privileges via a c...

CVE-2011-0660

The CVE-2011-0660 issue is a remote code execution vulnerability in the SMB client of several Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7 SP1). Root cause: the SMB client incorrectly validates crafted SMB responses (SMBv1 or SMBv2), enablin...

CVE-2011-1873

The CVE-2011-1873 entry documents a remote code execution flaw in win32k.sys, affecting 64-bit Windows systems (XP SP2, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7 SP1) where OpenType font parsing allows crafted OTF files to execute code in kernel mode. Root cause: impr...

CVE-2011-1884

CVE-2011-1884 describes a use-after-free vulnerability in the Windows kernel‑mode driver component win32k.sys. The flaw arises from incorrect management of driver objects in the Win32k subsystem, enabling a local attacker to gain privileges by running a crafted application. Affected platforms inc...

CVE-2012-0148

CVE-2012-0148 affects the Windows Ancillary Function Driver (afd.sys). The vulnerability stems from improper validation of user-mode input before crossing to kernel mode, enabling local privilege escalation. Affected on 64-bit Windows platforms: XP SP2, Server 2003 SP2, Vista SP2, Server 2008 SP2...

CVE-2013-1254

CVE-2013-1254 is a Windows kernel-mode driver (win32k.sys) local privilege-escalation vulnerability. A race condition in win32k.sys allows a local attacker to gain elevated privileges and read arbitrary kernel memory locations. Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2...

CVE-2013-1262

CVE-2013-1262 describes a race condition in the Windows kernel surface, specifically the win32k.sys kernel-mode driver. The vulnerability allows local attackers to gain privileges and read arbitrary kernel memory locations through a crafted application. Affected products include various Windows e...

CVE-2013-1269

The CVE-2013-1269 entry tracks a race condition in the Windows kernel-mode driver win32k.sys that enables local privilege escalation and arbitrary kernel memory disclosure. Affected products include Microsoft Windows XP (SP2–SP3), Windows Server 2003 (SP2), Windows Vista (SP2), Windows Server 200...

CVE-2013-1280

CVE-2013-1280 relates to multiple Windows kernel privilege-escalation vulnerabilities (the Windows kernel’s improper handling of objects in memory). Affected products span Windows XP SP2/3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, Windows 8, Server 2012 and Windows RT. Root ...

CVE-2002-1139

The CVE-2002-1139 issue affects Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP under the Compressed Folders feature. The root cause is that the destination folder is not properly validated during ZIP decompression, allowing an attacker to place an executable in a known location ...

CVE-2002-1932

CVE-2002-1932 affects Microsoft Windows XP and Windows 2000. When configured to send administrative alerts and with the "+Do not overwrite events (clear log manually)" option enabled, the system fails to notify administrators when the event log reaches its maximum size, allowing local users and r...

CVE-2005-1212

CVE-2005-1212 is a buffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe). A crafted bookmark link file with a long User field in extensions .cbo/.cbl/.cbm allows remote code execution, running with the caller’s privileges. The issue affects Step-by-Step Interactive Training ...

CVE-2006-2378

CVE-2006-2378 is a heap-based buffer overflow in the ART Image Rendering component (jgdw400.dll) used by AOL ART images in Microsoft Windows XP (SP1/SP2), Windows Server 2003 (SP1), and older/related OSes (including 98/Me). A crafted ART image can cause heap corruption, enabling remote code execu...

CVE-2007-1211

CVE-2007-1211 is the WMF/GDI-related vulnerability affecting Windows 2000 SP4, XP SP2, and Windows Server 2003 SP1/SP2 where a crafted WMF triggers an invalid dereference in a kernel structure, enabling user-assisted denial of service (potential persistent restart). The CVE is linked to CVE-2005-...

CVE-2007-5352

CVE-2007-5352 is a local privilege-escalation vulnerability in Microsoft Windows LSASS. The root cause is LSASS’s improper handling of specially crafted LPC requests, which could allow a local attacker to execute code with SYSTEM privileges and take full control of the affected system. Affected p...

CVE-2008-2251

CVE-2008-2251 describes a kernel double-free vulnerability in Windows that allows local privilege escalation when a crafted multi-threaded system-call flow mishandles user-supplied data. Affected products include Windows 2000 SP4, XP SP2/SP3, Server 2003 SP1/SP2, Windows Vista (Gold/SP1), and Win...

CVE-2009-1538

The CVE-2009-1538 family affects Microsoft DirectShow (quartz.dll) within DirectX 7.0–9.0c and DirectX/Windows DirectShow on Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2. A vulnerability exists in pointer validation when updating a QuickTime file, enabling remote code execution if a user ope...

CVE-2009-4311

CVE-2009-4311 describes an unspecified vulnerability in Microsoft's Indeo codec used by Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2, enabling remote code execution via crafted media content. Connected documents reference multiple SoCs (OpenVAS/NVD) and Microsoft security advisories (KB95575...

CVE-2010-4182

CVE-2010-4182 describes an untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) where a Trojan horse msjet49.dll in the same folder as a file processed by dao360.dll can lead to DLL hijacking and arbitrary code execution. Affected platforms include Windows XP ...

CVE-2011-0043

CVE-2011-0043 affects Kerberos in Windows XP SP2/SP3 and Windows Server 2003 SP2. The root cause is use of weak hashing (CRC32) in service tickets, enabling local privilege escalation by a crafted service ticket. Public mitigations are documented in MS11-013, which addresses Kerberos-related elev...

CVE-2011-0673

CVE-2011-0673 affects Windows XP SP3 with a NULL pointer de-reference in win32k.sys (kernel-mode). The issue allows local users to gain privileges via a crafted application, as part of a broader set of Windows kernel NULL-dereference and use-after-free vulnerabilities described under MS11-034 (Wi...

CVE-2011-1235

CVE-2011-1235 is a Windows kernel–mode driver use‑after‑free vulnerability in the Win32k subsystem (win32k.sys). Documents confirm a local privilege‑escalation vector via crafted applications that exploit incorrect driver object management, affecting multiple XP/Server 2003/Vista/Server 2008/Wind...

CVE-2013-1263

CVE-2013-1263 involves a race condition in the Windows kernel‑mode driver win32k.sys that permits local privilege escalation and reading of arbitrary kernel memory. Affected products (per sources) include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2 S...

CVE-2002-0699

The CVE-2002-0699 issue affects the Certificate Enrollment ActiveX Control used by Windows 98/98SE/Millennium/NT 4.0/2000/XP. The root cause is a flaw in the Certificate Enrollment Control that allows remote attackers to delete digital certificates on a user’s system via HTML. OpenVAS entries cor...

CVE-2003-0004

The CVE describes a buffer overflow in the Windows XP Redirector (RPC redirector) due to an unchecked/length parameter handling in the Windows Redirector service. Affected software: Microsoft Windows XP (XP Redirector/SMB Redirector). Root cause: unchecked length in received parameter information...

CVE-2004-0124

CVE-2004-0124 describes an information disclosure flaw in how Microsoft Windows COM object identifiers are created, enabling an attacker to coax a system into opening network ports via specially crafted RPC messages. This is part of MS04-012 RPC/DCOM updates; the impact is described as enabling a...

CVE-2005-1214

CVE-2005-1214 involves a spoofing flaw in Microsoft Agent that could allow remote attackers to impersonate trusted Internet content and potentially execute arbitrary code when a user visits a malicious Web page. Connected docs confirm the vulnerability (CAN-2005-1214) exists in Microsoft Agent an...

CVE-2005-1982

CVE-2005-1982 is a PKINIT vulnerability in Kerberos used by smart card logon on Windows 2000/XP/Server 2003. The flaw allows information disclosure and spoofing by injecting into an authentication session between a client and a domain controller, potentially enabling a malicious server to imperso...

CVE-2005-2122

CVE-2005-2122 corresponds to a Windows Shell buffer overflow in the handling of .lnk shortcut files, enabling remote code execution when a user opens a specially crafted shortcut or properties dialog. The issue affects Windows 2000 SP4, XP SP1/SP2, and Windows Server 2003, and is part of the MS05...

CVE-2006-2371

The CVE-2006-2371 issue is a buffer overflow in the Windows RRAS RASMAN RPC server (RASMAN) that affects Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier. A remote attacker can trigger arbitrary code execution via crafted RPC-related requests, resulting in registry corruption and sta...

CVE-2006-2373

CVE-2006-2373 : A local elevation-of-privilege in the SMB driver MRXSMB.SYS on affected Windows versions (Windows 2000 SP4, XP SP1/SP2, Server 2003 SP1 and earlier). The vulnerability arises from a logic/validation error in MRxSmbCscIoctlOpenForCopyChunk where, when invoked with METHOD_NEITHER, a...

CVE-2007-0026

The CVE-2007-0026 issue affects Microsoft Windows (older OSes: Windows 2000 SP4, XP SP2, 2003 SP1) where the OLE Dialog component parses OLE objects embedded in RTF documents. The root cause is improper validation when parsing embedded OLE objects in RTF, causing memory corruption that could allo...

CVE-2009-1808

Summary: CVE-2009-1808 affects Windows XP SP3. The vulnerability enables a local user to crash the system by abusing SPI_SETDESKWALLPAPER with a prematurely terminated pvParam, followed by SPI_GETDESKWALLPAPER via SystemParametersInfo. The underlying issue is a malformed pvParam handling in the W...

CVE-2010-0917

CVE-2010-0917 is a distinct VBScript vulnerability causing a stack-based buffer overflow via the MsgBox fourth argument when Internet Explorer is used, affecting VBScript.dll on Windows 2000 SP4, XP SP2/SP3, and Windows Server 2003 SP2. An attacker-user interaction in IE could enable code executi...

CVE-2013-3172

CVE-2013-3172 is a Windows kernel-mode driver vulnerability in win32k.sys causing a local denial of service (system hang) via a buffer overflow. Affected products include Windows XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2 SP1, and Windows 7 SP1. Remediation is via MS13-053 patches...

CVE-2013-3197

The CVE-2013-3197 issue affects the NTVDM subsystem in the Windows kernel on 32‑bit Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8. It arises from improper validation of kernel-memory addresses, enabling local privilege escalation...

CVE-2013-3899

The CVE-2013-3899 issue affects Windows kernel-mode drivers, specifically Win32k.sys, on Windows XP SP2/SP3 and Windows Server 2003 SP2. The vulnerability stems from improper address validation in Win32k.sys, enabling a local attacker to escalate privileges via a crafted application and potential...

CVE-2003-0009

CVE-2003-0009 is an XSS vulnerability in the Help and Support Center (HSC) of Windows Me (and XP) where hcp:// URIs pass arbitrary script in the topic parameter. The CERT/CC entry and CERT/CC notes explain that HSC does not adequately validate hcp:// URI parameters, allowing an attacker to cause ...

CVE-2004-2289

CVE-2004-2289 is the Windows XP Desktop.ini/ShellClassInfo variant that leads to arbitrary code execution via a .ShellClassInfo CLSID pointing to an executable. Connected docs show a related Windows Shell remote-code-execution vulnerability (CVE-2006-0012) in Windows Explorer triggered by COM obj...

CVE-2005-1985

Summary : CVE-2005-1985 describes a remote code execution vulnerability in the Microsoft Windows Client Service for NetWare (CSNW/Gateway Service for NetWare). Affected products/versions : Windows 2000 SP4, Windows XP SP1/SP2, and Windows Server 2003 SP1 and earlier, where CSNW is installed (by d...

CVE-2006-3942

CVE-2006-3942 is a denial-of-service vulnerability in the Windows Server Service (SRV.SYS) affecting Windows NT 4.0, 2000, XP, and Server 2003. A crafted SMB_COM_TRANSACTION SMB message containing a non-terminated string can cause a NULL dereference in ExecuteTransaction, crashing the system. The...

CVE-2007-0211

CVE-2007-0211 concerns a privilege-escalation vulnerability in the Windows Shell Hardware Detection component. The issue arises from an unvalidated parameter used during hardware detection and initialization, which could allow a local, authenticated user to gain complete control over the affected...