Vulnerabilities > Microsoft > Windows XP > High

DATE CVE VULNERABILITY TITLE RISK
2010-12-06 CVE-2010-4398 Out-of-bounds Write vulnerability in Microsoft products
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
local
low complexity
microsoft CWE-787
7.8
2010-07-22 CVE-2010-2568 Unspecified vulnerability in Microsoft products
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
local
low complexity
microsoft
7.8
2010-01-21 CVE-2010-0232 Unspecified vulnerability in Microsoft Windows 2000, Windows 7 and Windows XP
The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges by crafting a VDM_TIB data structure in the Thread Environment Block (TEB), and then calling the NtVdmControl function to start the Windows Virtual DOS Machine (aka NTVDM) subsystem, leading to improperly handled exceptions involving the #GP trap handler (nt!KiTrap0D), aka "Windows Kernel Exception Handler Vulnerability."
local
low complexity
microsoft
7.8
2009-07-15 CVE-2009-0231 Incorrect Conversion between Numeric Types vulnerability in Microsoft products
The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability."
network
low complexity
microsoft CWE-681
8.8
2009-06-10 CVE-2009-1123 Unspecified vulnerability in Microsoft products
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."
local
low complexity
microsoft
7.8
2008-05-13 CVE-2008-0322 Incorrect Permission Assignment for Critical Resource vulnerability in Microsoft Windows XP
The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which allows local users to gain privileges.
local
low complexity
microsoft CWE-732
7.8
2008-04-08 CVE-2008-0087 Use of Insufficiently Random Values vulnerability in Microsoft products
The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses.
network
low complexity
microsoft CWE-330
7.5
2004-07-27 CVE-2003-1048 Double Free vulnerability in Microsoft products
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
local
low complexity
microsoft CWE-415
7.8
2004-06-01 CVE-2004-0119 NULL Pointer Dereference vulnerability in Microsoft Windows 2000, Windows Server 2003 and Windows XP
The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from null dereference) or execute arbitrary code via a crafted SPNEGO NegTokenInit request during authentication protocol selection.
network
low complexity
microsoft CWE-476
7.5