CVSS: 5.5EPSS: 14%CPEs: 8EXPL: 3CVE-2005-4717 – Microsoft Internet Explorer 6 - Malformed HTML Parsing Denial of Service
https://notcve.org/view.php?id=CVE-2005-4717
31 Dec 2005 — Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar. • https://www.exploit-db.com/exploits/26457 •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 1CVE-2005-2827 – Microsoft Windows Server 2000 Kernel - APC Data-Free Local Escalation (MS05-055)
https://notcve.org/view.php?id=CVE-2005-2827
14 Dec 2005 — The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability." • https://www.exploit-db.com/exploits/1407 •
CVSS: 7.5EPSS: 47%CPEs: 2EXPL: 0CVE-2005-2150
https://notcve.org/view.php?id=CVE-2005-2150
11 Jul 2005 — Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does not properly prevent NULL sessions from accessing certain alternate named pipes, which allows remote attackers to (1) list Windows services via svcctl or (2) read eventlogs via eventlog. • http://marc.info/?l=bugtraq&m=112076409813099&w=2 •
CVSS: 9.8EPSS: 30%CPEs: 12EXPL: 1CVE-2005-1935
https://notcve.org/view.php?id=CVE-2005-1935
09 Jun 2005 — Heap-based buffer overflow in the BERDecBitString function in Microsoft ASN.1 library (MSASN1.DLL) allows remote attackers to execute arbitrary code via nested constructed bit strings, which leads to a realloc of a non-null pointer and causes the function to overwrite previously freed memory, as demonstrated using a SPNEGO token with a constructed bit string during HTTP authentication, and a different vulnerability than CVE-2003-0818. NOTE: the researcher has claimed that MS:MS04-007 fixes this issue. • http://www.phreedom.org/solar/exploits/msasn1-bitstring •
CVSS: 7.5EPSS: 44%CPEs: 55EXPL: 1CVE-2005-1184 – Multiple Vendor - TCP Session Acknowledgement Number Denial of Service
https://notcve.org/view.php?id=CVE-2005-1184
19 Apr 2005 — The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number, which generates a large number of "keep alive" packets. NOTE: some followups indicate that this issue could not be replicated. • https://www.exploit-db.com/exploits/25439 •
CVSS: 8.4EPSS: 51%CPEs: 55EXPL: 3CVE-2005-0416 – Microsoft Internet Explorer - '.ANI' Downloader (MS05-002)
https://notcve.org/view.php?id=CVE-2005-0416
14 Feb 2005 — The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers to execute arbitrary code via the AnimationHeaderBlock length field, which leads to a stack-based buffer overflow. La capacidad de Cursor Animado de Windows (archivos .ANI) de Windows NT, Windows 2000 hasta SP4, Windows XP hasta SP1, y Windows 2003 permite a atacantes remotos ejecutar código de su elección mediante el campo de longitud AnimationHeaderBlock, l... • https://www.exploit-db.com/exploits/771 •
CVSS: 9.8EPSS: 80%CPEs: 49EXPL: 1CVE-2005-0045 – Microsoft Windows - 'SMB' Transaction Response Handling (MS05-011)
https://notcve.org/view.php?id=CVE-2005-0045
08 Feb 2005 — The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allows remote attackers to execute arbitrary code via Transaction responses containing (1) Trans or (2) Trans2 commands, aka the "Server Message Block Vulnerability," and as demonstrated using Trans2 FIND_FIRST2 responses with large file name length fields. • https://www.exploit-db.com/exploits/1065 •
CVSS: 10.0EPSS: 49%CPEs: 37EXPL: 0CVE-2005-0050
https://notcve.org/view.php?id=CVE-2005-0050
08 Feb 2005 — The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability." • http://www.kb.cert.org/vuls/id/130433 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 50%CPEs: 6EXPL: 1CVE-2004-0567 – Microsoft Windows Server 2000 - WINS Remote Code Execution
https://notcve.org/view.php?id=CVE-2004-0567
31 Dec 2004 — The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly validate the computer name value in a WINS packet, which allows remote attackers to execute arbitrary code or cause a denial of service (server crash), which results in an "unchecked buffer" and possibly triggers a buffer overflow, aka the "Name Validation Vulnerability." • https://www.exploit-db.com/exploits/733 •
CVSS: 9.8EPSS: 44%CPEs: 9EXPL: 1CVE-2004-1049
https://notcve.org/view.php?id=CVE-2004-1049
31 Dec 2004 — Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large image size field, which leads to a buffer overflow, aka the "Cursor and Icon Format Handling Vulnerability." • http://marc.info/?l=bugtraq&m=110382891718076&w=2 •