W2
Product
Windows 2000
On CISA KEVExploited in the wild
514
CVEs
6
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 22Medium 5Low 0
Watch
Add Windows 2000 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-4250 In wildKEV | 9.8 | Oct 23 | Microsoft Windows Buffer Overflow Vulnerability Affected: All versions, or not specified |
| CVE-2009-1537 In wildKEV | 8.8 | May 29 | Microsoft DirectX NULL Byte Overwrite Vulnerability Affected: All versions, or not specified |
| CVE-2010-0232 In wildKEV | 7.8 | Jan 21 | Microsoft Windows Kernel Exception Handler Vulnerability Affected: All versions, or not specified |
| CVE-2009-1123 In wildKEV | 7.8 | Jun 10 | Microsoft Windows Improper Input Validation Vulnerability Affected: All versions, or not specified |
| CVE-2004-0210 In wildKEV | 7.8 | Jul 14 | Microsoft Windows Privilege Escalation Vulnerability Affected: All versions, or not specified |
| CVE-2002-0367 In wildKEV | 7.8 | Jun 25 | Microsoft Windows Privilege Escalation Vulnerability Affected: All versions, or not specified |
| CVE-2009-2494 | 9.8 | Aug 12 | The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2008-4835 | 9.8 | Jan 14 | SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2008-3465 | 9.8 | Dec 10 | Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent… Affected: All versions, or not specified |
| CVE-2002-0391 | 9.8 | Aug 12 | Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to… Affected: All versions, or not specified |
| CVE-2000-1218 | 9.8 | Apr 14 | The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS… Affected: All versions, or not specified |
| CVE-1999-0511 | 9.1 | Jan 1 | IP forwarding is enabled on a machine which is not a router or firewall Affected: All versions, or not specified |
| CVE-2009-1547 | 8.8 | Oct 14 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers… Affected: All versions, or not specified |
| CVE-2009-2493 | 8.8 | Jul 29 | The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and… Affected: All versions, or not specified |
| CVE-2009-0231 | 8.8 | Jul 15 | The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows… Affected: All versions, or not specified |
| CVE-2004-2339 | 8.4 | Dec 31 | Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the… Affected: All versions, or not specified |
| CVE-2009-3671 | 8.1 | Dec 9 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly… Affected: All versions, or not specified |
| CVE-2009-2529 | 8.1 | Oct 14 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2008-1083 | 8.1 | Apr 8 | Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote… Affected: All versions, or not specified |
| CVE-2010-0485 | 7.8 | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server… Affected: All versions, or not specified |
| CVE-2009-0082 | 7.8 | Mar 10 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate handles, which allows local users… Affected: All versions, or not specified |
| CVE-2004-0213 | 7.8 | Aug 6 | Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter"… Affected: All versions, or not specified |
| CVE-2002-0051 | 7.8 | Apr 4 | Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read access Affected: All versions, or not specified |
| CVE-2001-1238 | 7.8 | Jul 16 | Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the… Affected: All versions, or not specified |
| CVE-2008-0087 | 7.5 | Apr 8 | The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows remote attackers to spoof DNS responses Affected: All versions, or not specified |
| CVE-2004-0119 | 7.5 | Jun 1 | The Negotiate Security Software Provider (SSP) interface in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service (crash from… Affected: All versions, or not specified |
| CVE-2001-1515 | 7.5 | Dec 31 | Macintosh clients, when using NT file system volumes on Windows 2000 SP1, create subdirectories and automatically modify the inherited NTFS permissions, which may cause the… Affected: All versions, or not specified |
| CVE-2001-1452 | 7.5 | Aug 31 | By default, DNS servers on Windows NT 4.0 and Windows 2000 Server cache glue records received from non-delegated name servers, which allows remote attackers to poison the DNS… Affected: All versions, or not specified |
| CVE-2009-2516 | 7.1 | Oct 14 | The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly validate data sent from user mode, which… Affected: All versions, or not specified |
| CVE-2010-0488 | 6.5 | Mar 31 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and… Affected: All versions, or not specified |
| CVE-2010-0021 | 5.9 | Feb 10 | Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow… Affected: All versions, or not specified |
| CVE-2006-2374 | 5.5 | Jun 13 | The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service… Affected: All versions, or not specified |
| CVE-2002-0725 | 5.5 | Sep 5 | NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be… Affected: All versions, or not specified |
| CVE-2005-3170 | 5.0 | Oct 6 | The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer (LDAPS) even when the Certificate Authority (CA) is… Affected: All versions, or not specified |
| CVE-2007-6753 | – | Mar 28 | Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured… Affected: All versions, or not specified |
| CVE-2010-4562 | – | Feb 2 | Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo… Affected: All versions, or not specified |
| CVE-2010-1255 | – | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 Gold and SP2, Windows 7, and Server… Affected: All versions, or not specified |
| CVE-2010-0484 | – | Jun 8 | The Windows kernel-mode drivers in win32k.sys in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 "do not properly… Affected: All versions, or not specified |
| CVE-2010-0819 | – | Jun 8 | Unspecified vulnerability in the Windows OpenType Compact Font Format (CFF) driver in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008… Affected: All versions, or not specified |
| CVE-2010-1690 | – | May 7 | The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows… Affected: All versions, or not specified |
| CVE-2010-1689 | – | May 7 | The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier, Windows XP SP3 and earlier, Windows Server 2003 SP2 and earlier, Windows… Affected: All versions, or not specified |
| CVE-2010-1735 | – | May 6 | The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c… Affected: All versions, or not specified |
| CVE-2010-1734 | – | May 6 | The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d… Affected: All versions, or not specified |
| CVE-2010-0487 | – | Apr 14 | The Authenticode Signature verification functionality in cabview.dll in Cabinet File Viewer Shell Extension 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and… Affected: All versions, or not specified |
| CVE-2010-0486 | – | Apr 14 | The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista… Affected: All versions, or not specified |
| CVE-2010-0480 | – | Apr 14 | Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008… Affected: All versions, or not specified |
| CVE-2010-0478 | – | Apr 14 | Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2010-0269 | – | Apr 14 | The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows… Affected: All versions, or not specified |
| CVE-2010-0268 | – | Apr 14 | Unspecified vulnerability in the Windows Media Player ActiveX control in Windows Media Player (WMP) 9 on Microsoft Windows 2000 SP4 and XP SP2 and SP3 allows remote attackers to… Affected: All versions, or not specified |
| CVE-2010-0238 | – | Apr 14 | Unspecified vulnerability in registry-key validation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Vista Gold allows local users to cause a… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)