Local users in Windows NT can obtain administrator privileges by changing the KnownDLLs list to reference malicious programs.

Buffer overflow in the Mail-Max SMTP server for Windows systems allows remote command execution.

In some cases, Service Pack 4 for Windows NT 4.0 can allow access to network shares using a blank password, through a problem with a null NT hash value.

Windows 95 and Windows 98 systems, when configured with multiple TCP/IP stacks bound to the same MAC address, allow remote attackers to cause a denial of service (traffic amplification) via a certain ICMP echo (ping) packet, which causes all stacks to send a ping response, aka TCP Chorusing.

Windows 98 and other operating systems allows remote attackers to cause a denial of service via crafted "oshare" packets, possibly involving invalid fragmentation offsets.

Windows NT 4.0 beta allows users to read and delete shares.

The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user.

Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password.

Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.

Denial of service in telnet from the Windows NT Resource Kit, by opening then immediately closing a connection.

Windows NT automatically logs in an administrator upon rebooting.

A system-critical Windows NT file or directory has inappropriate permissions.

Windows NT is not using a password filter utility, e.g. PASSFILT.DLL.

A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories.

A Windows NT system's registry audit policy does not log an event success or failure for security-critical registry keys.

A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys.

The HKEY_LOCAL_MACHINE key in a Windows NT system has inappropriate, system-critical permissions.

The HKEY_CLASSES_ROOT key in a Windows NT system has inappropriate, system-critical permissions.

There is a one-way or two-way trust relationship between Windows NT domains.

A Windows NT file system is not NTFS.