Vulnerabilities > Microsoft > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2000-11-14 | CVE-2000-0834 | Unspecified vulnerability in Microsoft Windows 2000 The Windows 2000 telnet client attempts to perform NTLM authentication by default, which allows remote attackers to capture and replay the NTLM challenge/response via a telnet:// URL that points to the malicious server, aka the "Windows 2000 Telnet Client NTLM Authentication" vulnerability. | 7.5 |
| 2000-10-20 | CVE-2000-0777 | Unspecified vulnerability in Microsoft Money 2000/2001 The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the password, aka the "Money Password" vulnerability. | 7.2 |
| 2000-08-29 | CVE-2000-1079 | Unspecified vulnerability in Microsoft products Interactions between the CIFS Browser Protocol and NetBIOS as implemented in Microsoft Windows 95, 98, NT, and 2000 allow remote attackers to modify dynamic NetBIOS name cache entries via a spoofed Browse Frame Request in a unicast or UDP broadcast datagram. | 7.5 |
| 2000-07-20 | CVE-2000-0621 | Unspecified vulnerability in Microsoft Outlook and Outlook Express Microsoft Outlook 98 and 2000, and Outlook Express 4.0x and 5.0x, allow remote attackers to read files on the client's system via a malformed HTML message that stores files outside of the cache, aka the "Cache Bypass" vulnerability. | 7.5 |
| 2000-05-19 | CVE-2000-0305 | Resource Management Errors vulnerability in multiple products Windows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a large number of identical fragmented IP packets, aka jolt2 or the "IP Fragment Reassembly" vulnerability. | 7.8 |
| 2000-05-17 | CVE-2000-0464 | Unspecified vulnerability in Microsoft Internet Explorer Internet Explorer 4.x and 5.x allows remote attackers to execute arbitrary commands via a buffer overflow in the ActiveX parameter parsing capability, aka the "Malformed Component Attribute" vulnerability. | 7.6 |
| 2000-05-13 | CVE-2000-0400 | Improper Input Validation vulnerability in Microsoft Internet Explorer 5 The Microsoft Active Movie ActiveX Control in Internet Explorer 5 does not restrict which file types can be downloaded, which allows an attacker to download any type of file to a user's system by encoding it within an email message or news post. | 7.5 |
| 2000-05-11 | CVE-2000-0457 | Unspecified vulnerability in Microsoft products ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability. | 7.5 |
| 2000-05-11 | CVE-2000-0420 | Unspecified vulnerability in Microsoft Windows 2000 The default configuration of SYSKEY in Windows 2000 stores the startup key in the registry, which could allow an attacker tor ecover it and use it to decrypt Encrypted File System (EFS) data. | 7.2 |
| 2000-05-11 | CVE-2000-0419 | Unspecified vulnerability in Microsoft products The Office 2000 UA ActiveX Control is marked as "safe for scripting," which allows remote attackers to conduct unauthorized activities via the "Show Me" function in Office Help, aka the "Office 2000 UA Control" vulnerability. | 7.5 |