* SP2 * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2010-1735	20	DoS	2010-05-06	2019-04-30	4.9	None	Local	Low	Not required	None	None	Complete
The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
2	CVE-2010-1734	20	DoS	2010-05-06	2021-07-07	4.9	None	Local	Low	Not required	None	None	Complete
The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.
3	CVE-2008-4609	16	DoS	2008-10-20	2021-07-07	7.1	None	Remote	Medium	Not required	None	None	Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
4	CVE-2007-3898	16		2007-11-14	2021-07-07	6.4	None	Remote	Low	Not required	None	Partial	Partial
The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS servers, which allows remote attackers to spoof DNS replies, poison the DNS cache, and facilitate further attack vectors.
5	CVE-2007-2374		Exec Code	2007-04-30	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. NOTE: this information is based upon a vague pre-advisory with no actionable information. However, the advisory is from a reliable source.
6	CVE-2006-6696	119	Overflow +Priv	2006-12-22	2019-04-30	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Double free vulnerability in Microsoft Windows 2000, XP, 2003, and Vista allows local users to gain privileges by calling the MessageBox function with a MB_SERVICE_NOTIFICATION message with crafted data, which sends a HardError message to Client/Server Runtime Server Subsystem (CSRSS) process, which is not properly handled when invoking the UserHardError and GetHardErrorText functions in WINSRV.DLL.
7	CVE-2006-3880		DoS	2006-07-27	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP stack hang) via a continuous stream of packets on TCP port 135 that have incorrect TCP header checksums and random numbers in certain TCP header fields, as demonstrated by the Achilles Windows Attack Tool. NOTE: the researcher reports that the Microsoft Security Response Center has stated "Our investigation which has included code review, review of the TCPDump, and attempts on reproing the issue on multiple fresh installs of various Windows Operating Systems have all resulted in non confirmation."
8	CVE-2006-3443	264	+Priv	2006-08-09	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4, when SafeDllSearchMode is disabled, allows local users to gain privileges via a malicious DLL in the UserProfile directory, aka "User Profile Elevation of Privilege Vulnerability."
9	CVE-2006-2379	119	Exec Code Overflow	2006-06-13	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers to execute arbitrary code via unknown vectors related to IP source routing.
10	CVE-2006-2371		Exec Code Overflow	2006-06-13	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Remote Access Connection Manager service (RASMAN) service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," that lead to registry corruption and stack corruption, aka the "RASMAN Registry Corruption Vulnerability."
11	CVE-2006-2370		Exec Code Overflow Mem. Corr.	2006-06-13	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or authenticated attackers to execute arbitrary code via certain crafted "RPC related requests," aka the "RRAS Memory Corruption Vulnerability."
12	CVE-2006-1591		Exec Code Overflow	2006-04-03	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Heap-based buffer overflow in Microsoft Windows Help winhlp32.exe allows user-assisted attackers to execute arbitrary code via crafted embedded image data in a .hlp file.
13	CVE-2006-1313		Exec Code Mem. Corr.	2006-06-13	2019-04-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which results in memory corruption and allows remote attackers to execute arbitrary code.
14	CVE-2006-1184		DoS	2006-05-10	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0, 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length, which causes an out-of-range memory access, aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.
15	CVE-2006-0376			2006-01-22	2018-10-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The 802.11 wireless client in certain operating systems including Windows 2000, Windows XP, and Windows Server 2003 does not warn the user when (1) it establishes an association with a station in ad hoc (aka peer-to-peer) mode or (2) a station in ad hoc mode establishes an association with it, which allows remote attackers to put unexpected wireless communication into place.
16	CVE-2006-0143	399	DoS	2006-01-09	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.
17	CVE-2006-0034	119	Exec Code Overflow	2006-05-10	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the CRpcIoManagerServer::BuildContext function in msdtcprx.dll for Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 and Windows 2000 SP2 and SP3 allows remote attackers to execute arbitrary code via a long fifth argument to the BuildContextW or BuildContext opcode, which triggers a bug in the NdrAllocate function, aka the MSDTC Invalid Memory Access Vulnerability.
18	CVE-2006-0032	79	XSS	2006-09-12	2019-04-30	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
19	CVE-2006-0012		Exec Code	2006-04-12	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vectors involving COM objects and "crafted files and directories," aka the "Windows Shell Vulnerability."
20	CVE-2006-0010	119	Exec Code Overflow	2006-01-10	2019-04-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.
21	CVE-2005-3981			2005-12-04	2019-04-30	4.9	None	Local	Low	Not required	None	None	Complete
DISPUTED NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the CreateRemoteThread function with certain arguments on a process that has been opened using the OpenProcess function, possibly involving an invalid address for the start routine. NOTE: followup posts have disputed this issue, saying that if a user already has privileges to write to a process, then other functions could be called or the process could be terminated using PROCESS_TERMINATE.
22	CVE-2005-3945		DoS	2005-12-01	2019-04-30	7.8	None	Remote	Low	Not required	None	None	Complete
The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data, which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values, which slows down the hash table lookups.
23	CVE-2005-3644	399	DoS	2005-11-17	2019-04-30	7.8	None	Remote	Low	Not required	None	None	Complete
PNP_GetDeviceList (upnp_getdevicelist) in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a DCE RPC request that specifies a large output buffer size, a variant of CVE-2006-6296, and a different vulnerability than CVE-2005-2120.
24	CVE-2005-2827			2005-12-14	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability."
25	CVE-2005-2388		Exec Code Overflow	2005-07-27	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.
26	CVE-2005-2307		DoS	2005-07-19	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a large integer argument to a particular function, aka "Network Connection Manager Vulnerability."
27	CVE-2005-2122		Exec Code Overflow	2005-10-21	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote attackers to execute arbitrary commands via a shortcut (.lnk) file with long font properties that lead to a buffer overflow in the Client/Server Runtime Server Subsystem (CSRSS), a different vulnerability than CVE-2005-2118.
28	CVE-2005-2118		Exec Code Overflow	2005-10-21	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Windows Shell for Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 allows remote user-assisted attackers to execute arbitrary commands via a crafted shortcut (.lnk) file with long font properties that lead to a buffer overflow when the user views the file's properties using Windows Explorer, a different vulnerability than CVE-2005-2122.
29	CVE-2005-1935		Exec Code Overflow	2005-06-13	2017-07-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library (MSASN1.DLL) allows remote attackers to execute arbitrary code via nested constructed bit strings, which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory, as demonstrated using a SPNEGO token with a constructed bit string during HTTP authentication, and a different vulnerability than CVE-2003-0818. NOTE: the researcher has claimed that MS:MS04-007 fixes this issue.
30	CVE-2005-1218		DoS	2005-08-10	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests.
31	CVE-2005-1214		Exec Code	2005-06-14	2019-04-30	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
32	CVE-2005-1212		Exec Code Overflow	2005-06-14	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in Microsoft Step-by-Step Interactive Training (orun32.exe) allows remote attackers to execute arbitrary code via a bookmark link file (.cbo, cbl, or .cbm extension) with a long User field.
33	CVE-2005-1191			2005-05-02	2019-04-30	5.0	None	Remote	Low	Not required	None	Partial	None
The Web View DLL (webvw.dll), as used in Windows Explorer on Windows 2000 systems, does not properly filter an apostrophe ("'") in the author name in a document, which allows attackers to execute arbitrary script via extra attributes when Web View constructs a mailto: link for the preview pane when the user selects the file.
34	CVE-2005-1184		DoS	2005-05-02	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number, which generates a large number of "keep alive" packets. NOTE: some followups indicate that this issue could not be replicated.
35	CVE-2005-0803	399	DoS	2005-05-02	2019-04-30	5.0	None	Remote	Low	Not required	None	None	Partial
The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end, (2) emreof, or (3) palent offsets to be used, aka "Enhanced Metafile Vulnerability."
36	CVE-2005-0545		Bypass	2005-05-02	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Microsoft Windows XP Pro SP2 and Windows 2000 Server SP4 running Active Directory allow local users to bypass group policies that restrict access to hidden drives by using the browse feature in Office 10 applications such as Word or Excel, or using a flash drive. NOTE: this issue has been disputed in a followup post.
37	CVE-2005-0416		Exec Code Overflow	2005-04-27	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow.
38	CVE-2005-0063		Exec Code	2005-05-02	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.
39	CVE-2005-0061		+Priv	2005-05-02	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain access requests.
40	CVE-2005-0060		Overflow +Priv	2005-05-02	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via a specially-designed application.
41	CVE-2005-0059		Exec Code Overflow	2005-05-02	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a crafted message.
42	CVE-2005-0057		Exec Code Overflow	2005-05-02	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link that triggers an "unchecked buffer" in the library, possibly due to a buffer overflow.
43	CVE-2005-0053		Exec Code	2005-05-02	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability."
44	CVE-2005-0050	20	DoS Exec Code	2005-05-02	2019-04-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
45	CVE-2005-0048		DoS Exec Code	2005-05-02	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Microsoft Windows XP SP2 and earlier, 2000 SP3 and SP4, Server 2003, and older operating systems allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted IP packets with malformed options, aka the "IP Validation Vulnerability."
46	CVE-2005-0047		Exec Code	2005-05-02	2019-04-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Windows 2000, XP, and Server 2003 does not properly "validate the use of memory regions" for COM structured storage files, which allows attackers to execute arbitrary code, aka the "COM Structured Storage Vulnerability."
47	CVE-2005-0045		Exec Code	2005-05-02	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields.
48	CVE-2005-0044		Exec Code	2005-05-02	2019-04-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."
49	CVE-2004-1361		Exec Code Overflow	2004-12-23	2019-04-30	5.0	None	Remote	Low	Not required	None	Partial	None
Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file, which leads to a heap-based buffer overflow.
50	CVE-2004-1319			2004-12-15	2019-04-30	5.0	None	Remote	Low	Not required	None	Partial	None
The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is the window with the given name, then injecting the script from the parent into the child using execScript, as demonstrated by "AbusiveParent" in Internet Explorer 6.0.2900.2180.

Total number of vulnerabilities : 136 Page : 1 (This Page)2 3