The HKEY_CLASSES_ROOT key in a Windows NT system has inappropriate, system-critical permissions.

The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in.

TCP/IP implementation in Microsoft Windows 95, Windows NT 4.0, and possibly others, allows remote attackers to reset connections by forcing a reset (RST) via a PSH ACK or other means, obtaining the target's last sequence number from the resulting packet, then spoofing a reset to the target.

A Windows NT domain user or administrator account has a guessable password.

A Windows NT domain user or administrator account has a default, null, blank, or missing password.

The Windows NT guest account is enabled.

The Windows NT RPC service allows remote attackers to conduct a denial of service using spoofed malformed RPC packets which generate an error message that is sent to the spoofed host, potentially setting up a loop, aka Snork.

The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service), as demonstrated via a flood of random packets.

NT users can gain debug-level access on a system process using the Sechole exploit.

In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.

Windows NT 3.51 and 4.0 running WINS (Windows Internet Name Service) allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed packets, which causes the server to slow down and fill the event logs with error messages.

Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size.

Bonk variation of teardrop IP fragmentation denial of service.

Buffer overflow in War FTP allows remote execution of commands.

Memory leak in Simple Network Management Protocol (SNMP) agent (snmp.exe) for Windows NT 4.0 before Service Pack 4 allows remote attackers to cause a denial of service (memory consumption) via a large number of SNMP packets with Object Identifiers (OIDs) that cannot be decoded.

Teardrop IP denial of service.

A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.

Land IP denial of service.

The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories.

Listening TCP ports are sequentially allocated, allowing spoofing attacks.