CVE-2005-1985

Summary : CVE-2005-1985 describes a remote code execution vulnerability in the Microsoft Windows Client Service for NetWare (CSNW/Gateway Service for NetWare). Affected products/versions : Windows 2000 SP4, Windows XP SP1/SP2, and Windows Server 2003 SP1 and earlier, where CSNW is installed (by d...

CVE-2007-1212

The CVE-2007-1212 entry concerns a buffer overflow in the Graphics Device Interface (GDI) when processing Enhanced Metafile (EMF) images. Affected products listed in the initial description are Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, SP2; and Windows Vista. The underlying issue is a GDI ...

CVE-2009-4309

CVE-2009-4309 describes a heap-based buffer overflow in the Intel Indeo41 codec used by Windows Media Player, affecting Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2. The flaw arises from missing bounds checking on a size field in the IV41/movi record of an IV41 stream, permitting remote atta...

CVE-2009-4311

CVE-2009-4311 describes an unspecified vulnerability in Microsoft's Indeo codec used by Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2, enabling remote code execution via crafted media content. Connected documents reference multiple SoCs (OpenVAS/NVD) and Microsoft security advisories (KB95575...

CVE-2010-0379

Mode C: The CVE-2010-0378/CVE-2010-0379 family concerns Adobe Flash Player 6.0.79 in the Macromedia Flash ActiveX control for Windows XP SP2/SP3. The use-after-free vulnerability in CVE-2010-0378 allows remote code execution when unloading a Flash object being accessed by a script, causing memory...

CVE-2011-1226

The CVE-2011-1226 issue is a local privilege-escalation vulnerability in Windows kernel-mode driver code (win32k.sys) caused by a NULL pointer de-reference. A crafted local application can trigger this in multiple supported OS versions, including Windows XP (SP2–SP3), Windows Server 2003 (SP2), W...

CVE-2011-1232

CVE-2011-1232 affects Windows kernel-Mode drivers (win32k.sys) across XP SP2-SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2/SP1, and Windows 7 Gold/SP1. Root cause: NULL pointer dereference in Win32k subsystem allows a crafted application to escalate privileges from local user to ke...

CVE-2013-1261

CVE-2013-1261 describes a race condition in the win32k.sys kernel‑mode driver that can enable local privilege escalation and allow an attacker to read arbitrary kernel memory. Affected products include various Windows versions listed in the initial document (XP SP2/SP3, Server 2003 SP2, Vista SP2...

CVE-2013-1268

CVE-2013-1268 is a race-condition flaw in the Windows kernel-mode driver win32k.sys that enables local privilege escalation. A crafted user-space application can trigger the vulnerability to gain privileges and read arbitrary kernel memory. Affected Windows versions include XP SP2/SP3, Server 200...

CVE-2013-1269

The CVE-2013-1269 entry tracks a race condition in the Windows kernel-mode driver win32k.sys that enables local privilege escalation and arbitrary kernel memory disclosure. Affected products include Microsoft Windows XP (SP2–SP3), Windows Server 2003 (SP2), Windows Vista (SP2), Windows Server 200...

CVE-2001-0909

CVE-2001-0909 : Affected software is Microsoft Help Center on Windows XP, vulnerable via a buffer overflow in the helpctr.exe component when processing a long hcp: URL. This could allow a remote attacker to execute arbitrary code. CVSS v2 base score is 7.5 (HIGH) with network access, low attack c...

CVE-2003-0009

CVE-2003-0009 is an XSS vulnerability in the Help and Support Center (HSC) of Windows Me (and XP) where hcp:// URIs pass arbitrary script in the topic parameter. The CERT/CC entry and CERT/CC notes explain that HSC does not adequately validate hcp:// URI parameters, allowing an attacker to cause ...

CVE-2004-0474

CVE-2004-0474 affects Help Center (HelpCtr.exe). A remote attacker can supply an http:// or file:// URL as the topic parameter in an hcp:// URL to read or execute arbitrary files. The provided documents do not specify affected versions, exploitation status, or remediation steps.

CVE-2005-1212

CVE-2005-1212 is a buffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe). A crafted bookmark link file with a long User field in extensions .cbo/.cbl/.cbm allows remote code execution, running with the caller’s privileges. The issue affects Step-by-Step Interactive Training ...

CVE-2005-1982

CVE-2005-1982 is a PKINIT vulnerability in Kerberos used by smart card logon on Windows 2000/XP/Server 2003. The flaw allows information disclosure and spoofing by injecting into an authentication session between a client and a domain controller, potentially enabling a malicious server to imperso...

CVE-2005-2388

CVE-2005-2388 describes a buffer overflow in a USB driver used on Microsoft Windows that could allow an attacker to execute arbitrary code. The provided documents do not specify the affected product name, exact driver version, or root cause details beyond the general buffer overflow. Exploit info...

CVE-2006-2373

CVE-2006-2373 : A local elevation-of-privilege in the SMB driver MRXSMB.SYS on affected Windows versions (Windows 2000 SP4, XP SP1/SP2, Server 2003 SP1 and earlier). The vulnerability arises from a logic/validation error in MRxSmbCscIoctlOpenForCopyChunk where, when invoked with METHOD_NEITHER, a...

CVE-2006-2378

CVE-2006-2378 is a heap-based buffer overflow in the ART Image Rendering component (jgdw400.dll) used by AOL ART images in Microsoft Windows XP (SP1/SP2), Windows Server 2003 (SP1), and older/related OSes (including 98/Me). A crafted ART image can cause heap corruption, enabling remote code execu...

CVE-2006-3942

CVE-2006-3942 is a denial-of-service vulnerability in the Windows Server Service (SRV.SYS) affecting Windows NT 4.0, 2000, XP, and Server 2003. A crafted SMB_COM_TRANSACTION SMB message containing a non-terminated string can cause a NULL dereference in ExecuteTransaction, crashing the system. The...

CVE-2010-1888

CVE-2010-1888 is a Windows kernel privilege-escalation vulnerability described as a race condition in NtCreateThread during thread initialization, which could allow a local user to gain higher privileges on affected Windows versions (notably Windows XP SP3). The issue centers on how the CONTEXT-r...

CVE-2002-1932

CVE-2002-1932 affects Microsoft Windows XP and Windows 2000. When configured to send administrative alerts and with the "+Do not overwrite events (clear log manually)" option enabled, the system fails to notify administrators when the event log reaches its maximum size, allowing local users and r...

CVE-2004-0124

CVE-2004-0124 describes an information disclosure flaw in how Microsoft Windows COM object identifiers are created, enabling an attacker to coax a system into opening network ports via specially crafted RPC messages. This is part of MS04-012 RPC/DCOM updates; the impact is described as enabling a...

CVE-2004-2289

CVE-2004-2289 is the Windows XP Desktop.ini/ShellClassInfo variant that leads to arbitrary code execution via a .ShellClassInfo CLSID pointing to an executable. Connected docs show a related Windows Shell remote-code-execution vulnerability (CVE-2006-0012) in Windows Explorer triggered by COM obj...

CVE-2005-1184

The CVE-2005-1184 entry describes a DoS in the TCP/IP stack across multiple operating systems: a remote attacker sends a TCP packet with the correct sequence number but an incorrect Acknowledgement number, triggering a flood of keep-alive packets and CPU consumption. The impact is listed as Parti...

CVE-2005-3981

Microsoft Windows XP, 2000, and 2003 are affected by a local-privilege issue where a user can kill a writable process by calling CreateRemoteThread on a process opened via OpenProcess, using certain arguments and potentially an invalid start routine address. The underlying cause involves manipula...

CVE-2006-5586

CVE-2006-5586 is a GDI-based local privilege-elevation vulnerability in the Graphics Rendering Engine of Microsoft Windows 2000 SP4 and Windows XP SP2 (and related Windows variants). The flaw stems from processing invalid application window sizes when rendering layered windows, allowing a logged-...

CVE-2010-3144

CVE-2010-3144 concerns an insecure library loading vulnerability in the Internet Connection Signup Wizard (ICSW) affecting Windows XP SP2/SP3 and Windows Server 2003 SP2. The root cause is untrusted search path handling that allows loading a Trojan horse DLL (smmscrpt.dll) from the current direct...

CVE-2011-0039

The CVE-2011-0039 entry describes an elevation-of-privilege flaw in the Local Security Authority Subsystem Service (LSASS) on Windows XP SP2/SP3 and Windows Server 2003 SP2. The issue arises when LSASS processes specially crafted authentication requests with a manipulated length, enabling local u...

CVE-2011-2600

The CVE-2011-2600 issue affects the GPU support in Windows XP, where rendering time is not properly restricted. This enables remote denial of service (system crash) via WebGL vectors using (1) shader programs or (2) complex 3D geometry, demonstrated by visiting lots-of-polys-example.html in the K...

CVE-2013-1265

A race condition exists in the win32k.sys kernel-mode driver across multiple Microsoft Windows versions, including Windows XP (SP2-SP3) , Windows Server 2003 SP2 , Windows Vista SP2 , Windows Server 2008 (SP2 through R2 SP1) , and Windows 7 (Gold through SP1) . A local attacker can use a crafted ...

CVE-2002-1327

CVE-2002-1327 corresponds to a buffer overflow in the Windows Shell function used to extract audio file attributes (MP3/WMA) on Microsoft Windows XP. The flaw can be triggered remotely by a crafted audio file or through certain user interactions (folder browsing, web/HTML contexts) and could allo...

CVE-2004-0199

CVE-2004-0199 is a real vulnerability affecting the Help and Support Center in Windows XP and Windows Server 2003 SP1/64-Bit variants. The flaw arises from improper validation of HCP URLs (hcp://), enabling remote code execution when a user visits a crafted page or HTML e-mail that triggers the D...

CVE-2006-3445

Summary (CVE-2006-3445) : A memory corruption and heap-based overflow exists in Microsoft Agent when processing specially crafted .ACF files. The flaw occurs in the ReadWideString handling within agentdpv.dll and can be triggered via a remote attack, typically by convincing a user to view a malic...

CVE-2006-3648

CVE-2006-3648 describes an unhandled exception vulnerability in the Windows kernel/execution environment that could enable remote code execution on affected systems. The issue arises from improper exception handling in memory-resident applications, allowing a remote attacker to gain the same priv...

CVE-2006-4696

CVE-2006-4696 is a remote code execution vulnerability in the Windows Server Service (SMB Rename Vulnerability). It affects Windows 2000 SP4, Windows XP SP2 and earlier, and Windows Server 2003 SP1 and earlier, where a crafted SMB Rename request could cause the Server service to dereference an in...

CVE-2007-1912

CVE-2007-1912 relates to a heap-based buffer overflow in Microsoft Windows’ Help system (WinHelp) triggered by specially crafted .HLP files. The connected advisory CPAI-2007-254 describes a boundary/heap overflow in handling HLP files that could allow a remote attacker to inject and execute arbit...

CVE-2007-3463

Microsoft Windows XP SP2 local privilege escalation CVE-2007-3463 allows a user who has a RunAs session to terminate arbitrary processes of another user, demonstrated by taskkill. Root cause relates to RunAs/UAC being treated as convenience features, not security boundaries. The connected sources...

CVE-2007-3724

CVE-2007-3724 : The Windows XP kernel process scheduler does not use the kernel’s process statistics and instead bases scheduling on CPU billing gathered from periodic sampling ticks, which results in preferential treatment of “interactive” processes that sleep voluntarily. This behavior can allo...

CVE-2010-4182

CVE-2010-4182 describes an untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) where a Trojan horse msjet49.dll in the same folder as a file processed by dao360.dll can lead to DLL hijacking and arbitrary code execution. Affected platforms include Windows XP ...

CVE-2012-1866

CVE-2012-1866 concerns a local privilege escalation in the Windows kernel-mode drivers, specifically the win32k.sys component. The issue arises from improper handling of user-mode input passed to kernel-mode driver objects, enabling a local attacker to gain elevated privileges via a crafted appli...

CVE-2002-2105

CVE-2002-2105 affects Microsoft Windows XP. A local attacker can prevent the system from booting by corrupting the explorer.exe.manifest file, per the description. The entry specifies a local access vector, low complexity, no authentication required, and a partial impact on availability with no c...

CVE-2005-0051

CVE-2005-0051 concerns the Windows Server service (srvsvc.dll) on Windows XP SP1/SP2, where an anonymous logon over a named pipe can disclose authentication-related information about users accessing shared resources. The vulnerability enables remote information disclosure without code execution. ...

CVE-2005-4269

The affected component is mshtml.dll in Microsoft Windows XP, Windows Server 2003, and Internet Explorer 6.0 SP1. The issue arises when mshtml.dll processes button-focus events while a document is reloading, leading to a denial of service (access violation). This is observed in Microsoft Office I...

CVE-2006-3351

CVE-2006-3351 is a Windows Explorer vulnerability (explorer.exe) affecting Windows XP/2003 where parsing of .url files with InternetShortcut tags can overflow the stack. A crafted .url file containing a long URL and many file: specifiers may trigger a denial of service and possibly arbitrary code...

CVE-2010-3957

A double free vulnerability exists in the OpenType Font (OTF) driver in several legacy Microsoft Windows versions, including Windows XP SP2/SP3 , Windows Server 2003 SP2 , Windows Vista SP1/SP2 , Windows Server 2008 Gold/SP2/R2 , and Windows 7 . The root cause is the driver's failure to properly ...

CVE-2003-0897

The CVE-2003-0897 entry describes a local code-execution vulnerability in Windows XP related to CommCtl32.dll. The flaw arises when an attacker can send BCM_GETTEXTMARGIN or BCM_SETTEXTMARGIN button control messages to privileged applications, enabling arbitrary code execution on the affected sys...

CVE-2007-0214

CVE-2007-0214 affects the HTML Help ActiveX control (hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2/Professional, and Windows Server 2003 SP1. The vulnerability arises from improper input validation in HTML Help ActiveX methods, leading to a remote code execution flaw if a user visits a specia...

CVE-2007-5145

CVE-2007-5145 concerns multiple buffer overflows in Windows XP system DLLs (ntdll.dll; kernel32.dll) triggered by long strings in the File Properties fields (author, title, subject, comment). The issue involves improper handling of extended file attributes via FILE_INFORMATION_CLASS calls (e.g., ...

CVE-2008-4327

CVE-2008-4327 concerns gdiplus.dll (GDI+) in Windows XP SP3. The vulnerability arises from improper handling of crafted ICO files, specifically crash.ico on a web site or on the desktop, causing a divide-by-zero error and a denial of service (application crash). The connected records corroborate ...

CVE-2010-0818

The CVE-2010-0818 issue affects the MPEG-4 codec in Windows Media codecs on Windows XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, and Server 2008 Gold/SP2. Root cause: a buffer/handling flaw in the MPEG-4 codec when processing specially crafted media content with MPEG-4 video encoding, allowing rem...