CVE-2004-0123

CVE-2004-0123 (ASN.1 “Double Free”) affects Windows platforms including NT 4.0, Windows 2000, Windows XP, and Windows Server 2003. The issue is a potential memory-management error caused by a possible double-free condition in the Microsoft ASN.1 Library, which could lead to memory corruption and,...

CVE-2004-0208

CVE-2004-0208 is a local privilege-elevation vulnerability in the Windows kernel/VDM subsystem. The Windows Virtual DOS Machine (VDM) component could allow an authenticated, locally logged-on attacker to gain kernel privileges by executing code in memory areas not properly validated when handling...

CVE-2004-1306

The connected advisories confirm a heap-based buffer overflow in winhlp32.exe that can be triggered by a crafted .hlp file, exposing remote code execution on affected Windows versions: Windows NT, Windows 2000 (SP4), Windows XP (SP2), and Windows Server 2003. Root cause: unsafe handling during ph...

CVE-2005-0061

CVE-2005-0061 (Windows kernel elevation of privilege) is a local privilege-elevation vulnerability in the Windows kernel (Windows 2000, XP SP1/SP2, Windows Server 2003) caused by the way the kernel processes certain access requests. An attacker with valid logon credentials and local access could ...

CVE-2005-4717

Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1/SP2, and Windows Server 2003 SP1 is affected. A vulnerability in the rendering path (DIV containing a malformed IMG tag) combined with a malformed CSS/HTML file can trigger a null dereference, causing a remot...

CVE-2006-1591

CVE-2006-1591 describes a heap-based buffer overflow in Microsoft Windows Help winhlp32.exe caused by improper parsing of malformed .hlp files. The vulnerability permits user-assisted attackers to execute arbitrary code by crafting an embedded image data payload within a Windows Help (.hlp) file....

CVE-2009-3673

Microsoft Internet Explorer 7/8 are affected by CVE-2009-3673 (Uninitialized Memory Corruption). A remote code execution vulnerability exists due to improper handling of memory for objects that are uninitialized or deleted, exploitable via a specially crafted web page and potentially via heap spr...

CVE-2010-0917

CVE-2010-0917 is a distinct VBScript vulnerability causing a stack-based buffer overflow via the MsgBox fourth argument when Internet Explorer is used, affecting VBScript.dll on Windows 2000 SP4, XP SP2/SP3, and Windows Server 2003 SP2. An attacker-user interaction in IE could enable code executi...

CVE-2010-2740

The CVE-2010-2740 entry corresponds to two Windows OpenType Font (OTF) format driver vulnerabilities (CVE-2010-2740 and CVE-2010-2741) affecting Windows XP SP2/SP3 and Windows Server 2003 SP2. The OpenType Font (OTF) format driver is vulnerable in how it allocates memory when parsing specially cr...

CVE-2011-0670

CVE-2011-0670 describes a use-after-free vulnerability in win32k.sys within Windows kernel-mode drivers that enables local privilege escalation. Affected are Windows XP (SP2/SP3), Windows Server 2003 (SP2), Windows Vista (SP1/SP2), Windows Server 2008 (Gold, SP2, R2, R2 SP1), and Windows 7 (Gold,...

CVE-2011-1225

The CVE-2011-1225 issue affects the Windows kernel32k subsystem: specifically, win32k.sys in kernel-mode drivers allows local privilege escalation via a NULL pointer de-reference. Affected products include Windows XP (SP2–SP3), Windows Server 2003 (SP2), Windows Vista (SP1–SP2), Windows Server 20...

CVE-2011-1234

CVE-2011-1234 is a use-after-free vulnerability in the Windows kernel-mode driver component win32k.sys that enables local privilege escalation. The issue arises from incorrect driver object management in the kernel, affecting multiple Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, ...

CVE-2011-1240

CVE-2011-1240 is a local privilege-escalation in the Windows kernel via the Win32k.sys use-after-free condition. A crafted local attack can abuse incorrect driver object management to execute code with kernel privileges on affected Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Ser...

CVE-2011-1242

CVE-2011-1242 is a Win32k.sys use-after-free local privilege-escalation vulnerability. Affected: Windows XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2/R2 SP1, and Windows 7 SP1. Cause: incorrect management of kernel-mode driver objects in win32k.sys leading to use-after-free...

CVE-2012-1868

CVE-2012-1868 is a local privilege-escalation vulnerability in Windows, caused by a race condition in the thread-creation path of win32k.sys (kernel-mode drivers). Exploitation would allow a local attacker to gain SYSTEM-level privileges via a crafted application on affected Windows XP SP3 system...

CVE-2013-3878

CVE-2013-3878 describes a local POST- exploitation vulnerability in the LRPC client of Microsoft Windows XP SP2/SP3 and Windows Server 2003 SP2. The issue is a stack-based buffer overflow triggered when an LRPC server sends a crafted LPC port message, allowing an authenticated local attacker to g...

CVE-2001-1200

CVE-2001-1200 affects Microsoft Windows XP. The vulnerability allows local users to bypass a locked screen and execute programs associated with hot keys. The NVD entry lists a local attack vector with low complexity and complete impact to confidentiality, integrity, and availability (base score 7...

CVE-2005-0060

CVE-2005-0060 is a local privilege-elevation vulnerability in the Windows font-processing subsystem caused by an unchecked buffer when handling certain fonts. A logged-on user could gain full control of an affected system by running a specially crafted application. Affected platforms include Wind...

CVE-2005-0545

CVE-2005-0545 affects Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 in Active Directory environments. The issue allows local users to bypass group policies that restrict access to hidden drives by using Office 10 applications (Word/Excel) Browse feature or via a flash drive. The vulner...

CVE-2005-2122

CVE-2005-2122 corresponds to a Windows Shell buffer overflow in the handling of .lnk shortcut files, enabling remote code execution when a user opens a specially crafted shortcut or properties dialog. The issue affects Windows 2000 SP4, XP SP1/SP2, and Windows Server 2003, and is part of the MS05...

CVE-2005-3177

Affected software : Microsoft Windows 2000 (before Update Rollup 1 for SP4), Windows XP, and Windows Server 2003. Vulnerable component : CHKDSK running in fix mode. Root cause : CHKDSK does not properly handle security descriptors when the master file table contains a large number of files or whe...

CVE-2005-4696

CVE-2005-4696 concerns the Microsoft Wireless Zero Configuration system (WZCS). The vulnerability arises because WZCS stores WEP keys and pair‑wise Master Keys (PMKs) for the WPA pre‑shared key in plaintext in the memory of the explorer process, enabling attackers with local memory access to extr...

CVE-2006-3880

The CVE affects Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003. The issue is a DoS via a continuous stream of TCP port 135 packets carrying incorrect TCP header checksums and random values in certain TCP header fields (demonstrated by the Achilles Windo...

CVE-2008-0083

CVE-2008-0083 affects Microsoft VBScript/JScript scripting engines (VBScript.dll and JScript.dll) version 5.1 and 5.6 used in Windows 2000 SP4, XP SP2, and Server 2003 SP1/SP2. A vulnerability in decoding scripts in Web pages and in memory loading could allow remote code execution through unknown...

CVE-2008-1086

The CVE-2008-1086 issue concerns the hxvz.dll ActiveX control (HxTocCtrl) used by Microsoft Help 2.5 and exposed in Internet Explorer on Windows XP SP2, Server 2003 SP1/SP2, Vista SP1, and Server 2008. The vulnerability is a memory corruption flaw triggered by malformed arguments to the ActiveX c...

CVE-2008-1456

CVE-2008-1456 describes a remote code execution vulnerability in the Windows Event System caused by improper validation when indexing an array of function pointers. Affected products include Windows 2000 SP4, XP (SP2/SP3), Server 2003 (SP1/SP2), Vista (initial and SP1), and Server 2008. The issue...

CVE-2008-3648

The nslookup.exe utility in Microsoft Windows XP SP2 is vulnerable to a Remote Code Execution (RCE) flaw. This vulnerability allows user-assisted remote attackers to execute arbitrary code, a condition demonstrated via an attempted DNS zone transfer . The issue is classified under CWE-94: Imprope...

CVE-2011-0672

CVE-2011-0672 is a use-after-free vulnerability in the Windows kernel Win32k.sys (kernel-mode drivers). Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP1/SP2, Windows Server 2008 Gold/SP2/R2/R2 SP1, and Windows 7 Gold/SP1. The issue stems from incorrect driv...

CVE-2011-0673

CVE-2011-0673 affects Windows XP SP3 with a NULL pointer de-reference in win32k.sys (kernel-mode). The issue allows local users to gain privileges via a crafted application, as part of a broader set of Windows kernel NULL-dereference and use-after-free vulnerabilities described under MS11-034 (Wi...

CVE-2011-0674

CVE-2011-0674 is a use-after-free in the Windows kernel-mode driver win32k.sys that allows local privilege escalation. Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP1/SP2, Windows Server 2008 SP2/R2, and Windows 7 SP1. Root cause: incorrect management of k...

CVE-2011-1243

The CVE-2011-1243 issue affects the Windows Messenger ActiveX control (msgsc.dll) in Windows XP SP2/SP3. The vulnerability allows remote code execution via unspecified vectors that corrupt the system state. Affected product/component: Windows Messenger ActiveX in msgsc.dll. Root cause: control co...

CVE-2012-1867

CVE-2012-1867 is a local privilege-escalation flaw in Windows where an integer overflow in win32k.sys (font resource handling) could allow a local attacker to gain SYSTEM-level privileges via a crafted TrueType font. Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows V...

CVE-2012-2527

CVE-2012-2527 is a use-after-free vulnerability in win32k.sys (kernel-mode drivers) that affects Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2/R2 SP1, and Windows 7 Gold/SP1. The flaw allows local users to gain privileges via a crafted application, wit...

CVE-2013-1256

CVE-2013-1256 describes a race condition in the Windows kernel-mode driver win32k.sys that allows local privilege escalation and reading arbitrary kernel memory. Affected products span Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2/R2 SP1, and Windows 7...

CVE-2013-3899

The CVE-2013-3899 issue affects Windows kernel-mode drivers, specifically Win32k.sys, on Windows XP SP2/SP3 and Windows Server 2003 SP2. The vulnerability stems from improper address validation in Win32k.sys, enabling a local attacker to escalate privileges via a crafted application and potential...

CVE-2002-0283

CVE-2002-0283 affects Windows XP where an attacker can induce CPU consumption (DoS) by sending a flood of TCP SYN packets with possibly malformed data to port 445 (SMB). This is a network-vector, low-complexity attack requiring no authentication, with the impact described as partial availability....

CVE-2002-0692

The CVE-2002-0692 issue concerns a buffer overflow in Microsoft FrontPage Server Extensions’ SmartHTML interpreter (shtml.dll). FPSE 2000 is affected by denial of service (CPU consumption); FPSE 2002 can allow remote code execution via a crafted web-file request. The vulnerability is tied to the ...

CVE-2002-1214

CVE-2002-1214 describes a buffer overflow in Microsoft PPTP Service affecting Windows XP and Windows 2000 (and Terminal Services) that can be triggered by a PPTP control data packet with malformed data. The vulnerability can lead to a denial of service and, in some cases, may allow the attacker t...

CVE-2003-0112

CVE-2003-0112 corresponds to a local privilege‑escalation in the Windows kernel. Technical details from connected docs show a buffer/stack overflow in ntoskrnl.exe related to debugging message handling (LpcRequestWaitReplyPort), enabling a local attacker to execute code with kernel privileges. Af...

CVE-2005-1214

CVE-2005-1214 involves a spoofing flaw in Microsoft Agent that could allow remote attackers to impersonate trusted Internet content and potentially execute arbitrary code when a user visits a malicious Web page. Connected docs confirm the vulnerability (CAN-2005-1214) exists in Microsoft Agent an...

CVE-2006-3442

This CVE affects Microsoft Windows XP (XP SP1/SP2) with the MSMQ/ Pragmatic General Multicast (PGM) implementation. The root cause is an invalid memory access/buffer overflow in PGM within MSMQ, enabling a remote attacker to execute code on a vulnerable system by sending a specially crafted multi...

CVE-2007-1205

CVE-2007-1205 is a remote code execution vulnerability in Microsoft Agent (msagent\agentsvr.exe) on Windows 2000 SP4, Windows XP SP2, and Windows Server 2003 SP1/SP2. The flaw arises from how Microsoft Agent handles certain specially crafted URLs, leading to memory corruption and arbitrary code e...

CVE-2008-1453

The CVE-2008-1453 issue affects the Windows Bluetooth stack in Windows XP SP2/SP3 and Windows Vista SP1. It arises from how the Bluetooth stack handles a large number of Service Description Protocol (SDP) requests, allowing physically proximate attackers to execute arbitrary code and potentially ...

CVE-2009-4311

CVE-2009-4311 describes an unspecified vulnerability in Microsoft's Indeo codec used by Windows 2000 SP4, XP SP2/SP3, and Server 2003 SP2, enabling remote code execution via crafted media content. Connected documents reference multiple SoCs (OpenVAS/NVD) and Microsoft security advisories (KB95575...

CVE-2010-1098

The CVE-2010-1098 entry describes a denial-of-service flaw in the ANI parser found in Microsoft Windows prior to 7 on x86, used by Internet Explorer and other apps. A crafted biClrUsed value in the BITMAPINFO header of a .ANI file can cause memory and CPU exhaustion, leading to a DoS condition. A...

CVE-2010-2567

CVE-2010-2567 is an RPC memory corruption vulnerability in the Windows XP SP2/SP3 and Windows Server 2003 SP2 RPC client. The root cause is improper memory allocation while parsing RPC responses, which allows a remote server or a man-in-the-middle attacker to execute arbitrary code via a malforme...

CVE-2011-0089

CVE-2011-0089 affects Windows kernel-mode driver win32k.sys across multiple OS versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7). The issue is improper validation of user-mode data by the Win32k subsystem, enabling local users to gain privileges via a c...

CVE-2011-0660

The CVE-2011-0660 issue is a remote code execution vulnerability in the SMB client of several Windows versions (XP SP2/SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 Gold/SP2/R2, and Windows 7 SP1). Root cause: the SMB client incorrectly validates crafted SMB responses (SMBv1 or SMBv2), enablin...

CVE-2011-1227

CVE-2011-1227 affects the Windows kernel’s win32k.sys (kernel-mode drivers). The vulnerability is a NULL pointer de-reference in the Win32k subsystem that enables local attackers to gain privileges on multiple Windows versions, including Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista ...

CVE-2011-1235

CVE-2011-1235 is a Windows kernel–mode driver use‑after‑free vulnerability in the Win32k subsystem (win32k.sys). Documents confirm a local privilege‑escalation vector via crafted applications that exploit incorrect driver object management, affecting multiple XP/Server 2003/Vista/Server 2008/Wind...