Buffer overflow in Microsoft Rich Text Format (RTF) reader allows attackers to cause a denial of service via a malformed control word.

DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes.

Buffer overflow in Microsoft Phone Dialer (dialer.exe), via a malformed dialer entry in the dialer.ini file.

Denial of service in Windows NT Local Security Authority (LSA) through a malformed LSA request.

Denial of service in various Windows systems via malformed, fragmented IGMP packets.

An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header.

The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.

Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

Windows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option.

Buffer overflow in Remote Access Service (RAS) client allows an attacker to execute commands or cause a denial of service via a malformed phonebook entry.

Buffer overflow in Windows NT 4.0 help file utility via a malformed help file.

A remote attacker can disable the virus warning mechanism in Microsoft Excel 97.

The installer for BackOffice Server includes account names and passwords in a setup file (reboot.ini) which is not deleted.

The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user.

The Forms 2.0 ActiveX control (included with Visual Basic for Applications 5.0) can be used to read text from a user's clipboard when the user accesses documents with ActiveX content.

A Windows NT domain user or administrator account has a guessable password.

A Windows NT domain user or administrator account has a default, null, blank, or missing password.

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

A version of finger is running that exposes valid user information to any entity on the network.

Windows NT RSHSVC program allows remote users to execute arbitrary commands.