Vulnerabilities > Microsoft > Windows Server 2003

DATE CVE VULNERABILITY TITLE RISK
2011-10-12 CVE-2011-2005 Unspecified vulnerability in Microsoft Windows Server 2003 and Windows XP
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
local
low complexity
microsoft
7.8
2010-12-06 CVE-2010-4398 Out-of-bounds Write vulnerability in Microsoft products
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
local
low complexity
microsoft CWE-787
7.8
2009-07-15 CVE-2009-0231 Incorrect Conversion between Numeric Types vulnerability in Microsoft products
The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability."
network
low complexity
microsoft CWE-681
8.8
2009-06-10 CVE-2009-1123 Unspecified vulnerability in Microsoft products
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."
local
low complexity
microsoft
7.8
2008-04-08 CVE-2008-0087 Use of Insufficiently Random Values vulnerability in Microsoft products
The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.
network
low complexity
microsoft CWE-330
7.5
2004-07-27 CVE-2003-1048 Double Free vulnerability in Microsoft products
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
local
low complexity
microsoft CWE-415
7.8
2004-06-01 CVE-2004-0119 NULL Pointer Dereference vulnerability in Microsoft Windows 2000, Windows Server 2003 and Windows XP
The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.
network
low complexity
microsoft CWE-476
7.5