W2
Product
Windows 2000
On CISA KEVExploited in the wild
514
CVEs
6
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 22Medium 5Low 0
Watch
Add Windows 2000 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-0901 | – | Jan 10 | Microsoft Word for Windows 6.0 Converter (MSWRD632.WPC), as used in WordPad, does not properly validate certain data lengths, which allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2004-0894 | – | Jan 10 | LSASS (Local Security Authority Subsystem Service) of Windows 2000 Server and Windows Server 2003 does not properly validate connection information, which allows local users to… Affected: All versions, or not specified |
| CVE-2004-0893 | – | Jan 10 | The Local Procedure Call (LPC) interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of… Affected: All versions, or not specified |
| CVE-2004-0571 | – | Jan 10 | Microsoft Word for Windows 6.0 Converter does not properly validate certain data lengths, which allows remote attackers to execute arbitrary code via a .wri, .rtf, and .doc file… Affected: All versions, or not specified |
| CVE-2004-0568 | – | Jan 10 | HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file,… Affected: All versions, or not specified |
| CVE-2004-1049 | – | Dec 31 | Integer overflow in the LoadImage API of the USER32 Lib for Microsoft Windows allows remote attackers to execute arbitrary code via a .bmp, .cur, .ico or .ani file with a large… Affected: All versions, or not specified |
| CVE-2004-1306 | – | Dec 31 | Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via… Affected: All versions, or not specified |
| CVE-2004-0567 | – | Dec 31 | The Windows Internet Naming Service (WINS) in Windows NT Server 4.0 SP 6a, NT Terminal Server 4.0 SP 6, Windows 2000 Server SP3 and SP4, and Windows Server 2003 does not properly… Affected: All versions, or not specified |
| CVE-2004-1361 | – | Dec 23 | Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a… Affected: All versions, or not specified |
| CVE-2004-1305 | – | Dec 23 | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers to cause a denial of service… Affected: All versions, or not specified |
| CVE-2004-1319 | – | Dec 15 | The DHTML Edit Control (dhtmled.ocx) allows remote attackers to inject arbitrary web script into other domains by setting a name for a window, opening a child page whose target is… Affected: All versions, or not specified |
| CVE-2004-0574 | – | Nov 3 | The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003… Affected: All versions, or not specified |
| CVE-2004-0214 | – | Nov 3 | Buffer overflow in Microsoft Internet Explorer and Explorer on Windows XP SP1, WIndows 2000, Windows 98, and Windows Me may allow remote malicious servers to cause a denial of… Affected: All versions, or not specified |
| CVE-2004-0209 | – | Nov 3 | Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code… Affected: All versions, or not specified |
| CVE-2004-0208 | – | Nov 3 | The Virtual DOS Machine (VDM) subsystem of Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows local users to access kernel memory and gain… Affected: All versions, or not specified |
| CVE-2004-0207 | – | Nov 3 | "Shatter" style vulnerability in the Window Management application programming interface (API) for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows… Affected: All versions, or not specified |
| CVE-2004-0206 | – | Nov 3 | Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows attackers to remotely execute… Affected: All versions, or not specified |
| CVE-2004-1649 | – | Aug 31 | Buffer overflow in Microsoft Msinfo32.exe might allow local users to execute arbitrary code via a long filename in the msinfo_file command line parameter Affected: All versions, or not specified |
| CVE-2004-0839 | – | Aug 18 | Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and… Affected: All versions, or not specified |
| CVE-2004-0201 | – | Aug 6 | Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2004-0540 | – | Aug 6 | Microsoft Windows 2000, when running in a domain whose Fully Qualified Domain Name (FQDN) is exactly 8 characters long, does not prevent users with expired passwords from logging… Affected: All versions, or not specified |
| CVE-2004-0212 | – | Aug 6 | Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet Explorer 6 on Windows NT 4.0, allows local or remote attackers to execute arbitrary code… Affected: All versions, or not specified |
| CVE-2004-0202 | – | Aug 6 | IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b, as used in Windows Server 2003 and earlier allows remote attackers to cause a denial… Affected: All versions, or not specified |
| CVE-2004-0726 | – | Jul 27 | The Windows Media Player control in Microsoft Windows 2000 allows remote attackers to execute arbitrary script in the local computer zone via an ASX filename that contains… Affected: All versions, or not specified |
| CVE-2004-0124 | – | Jun 1 | The DCOM RPC interface for Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause network communications via an "alter context" call that contains… Affected: All versions, or not specified |
| CVE-2004-0123 | – | Jun 1 | Double free vulnerability in the ASN.1 library as used in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service… Affected: All versions, or not specified |
| CVE-2004-0120 | – | Jun 1 | The Microsoft Secure Sockets Layer (SSL) library, as used in Windows 2000, Windows XP, and Windows Server 2003, allows remote attackers to cause a denial of service via malformed… Affected: All versions, or not specified |
| CVE-2004-0118 | – | Jun 1 | The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures, which allows local users to access… Affected: All versions, or not specified |
| CVE-2004-0117 | – | Jun 1 | Unknown vulnerability in the H.323 protocol implementation in Windows 98, Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code Affected: All versions, or not specified |
| CVE-2004-0116 | – | Jun 1 | An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000, XP, and 2003 allows remote attackers to cause a denial of service (memory… Affected: All versions, or not specified |
| CVE-2003-0910 | – | Jun 1 | The NtSetLdtEntries function in the programming interface for the Local Descriptor Table (LDT) in Windows NT 4.0 and Windows 2000 allows local attackers to gain access to kernel… Affected: All versions, or not specified |
| CVE-2003-0908 | – | Jun 1 | The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "Shatter" style attack using a… Affected: All versions, or not specified |
| CVE-2003-0906 | – | Jun 1 | Buffer overflow in the rendering for (1) Windows Metafile (WMF) or (2) Enhanced Metafile (EMF) image formats in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1… Affected: All versions, or not specified |
| CVE-2003-0807 | – | Jun 1 | Buffer overflow in the COM Internet Services and in the RPC over HTTP Proxy components for Microsoft Windows NT Server 4.0, NT 4.0 Terminal Server Edition, 2000, XP, and Server… Affected: All versions, or not specified |
| CVE-2003-0806 | – | Jun 1 | Buffer overflow in the Windows logon process (winlogon) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, and XP SP1, when a member of a domain, allows remote attackers to… Affected: All versions, or not specified |
| CVE-2003-0719 | – | Jun 1 | Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4,… Affected: All versions, or not specified |
| CVE-2003-0533 | – | Jun 1 | Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a,… Affected: All versions, or not specified |
| CVE-2003-0663 | – | Jun 1 | Unknown vulnerability in the Local Security Authority Subsystem Service (LSASS) in Windows 2000 domain controllers allows remote attackers to cause a denial of service via a… Affected: All versions, or not specified |
| CVE-2004-0230 | – | May 5 | TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections… Affected: All versions, or not specified |
| CVE-2003-0825 | – | Mar 3 | The Windows Internet Naming Service (WINS) for Microsoft Windows Server 2003, and possibly Windows NT and Server 2000, does not properly validate the length of certain packets,… Affected: All versions, or not specified |
| CVE-2003-0818 | – | Mar 3 | Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries on Windows NT 4.0, 2000, and… Affected: All versions, or not specified |
| CVE-2002-0034 | – | Feb 3 | The Microsoft CONVERT.EXE program, when used on Windows 2000 and Windows XP systems, does not apply the default NTFS permissions when converting a FAT32 file system, which could… Affected: All versions, or not specified |
| CVE-2003-0995 | – | Jan 5 | Buffer overflow in the Microsoft Message Queue Manager (MSQM) allows remote attackers to cause a denial of service (RPC service crash) via a queue registration request Affected: All versions, or not specified |
| CVE-2003-1544 | – | Dec 31 | Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by… Affected: All versions, or not specified |
| CVE-2003-1448 | – | Dec 31 | Memory leak in the Windows 2000 kernel allows remote attackers to cause a denial of service (SMB request hang) via a NetBIOS continuation packet Affected: All versions, or not specified |
| CVE-2003-0824 | – | Dec 15 | Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote… Affected: All versions, or not specified |
| CVE-2003-0822 | – | Dec 15 | Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a… Affected: All versions, or not specified |
| CVE-2003-0812 | – | Dec 15 | Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via RPC calls that cause long… Affected: All versions, or not specified |
| CVE-2003-0813 | – | Nov 17 | A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by… Affected: All versions, or not specified |
| CVE-2003-0717 | – | Nov 17 | The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute arbitrary code via a buffer… Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)