The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service), as demonstrated via a flood of random packets.

NT users can gain debug-level access on a system process using the Sechole exploit.

In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.

Windows NT 3.51 and 4.0 running WINS (Windows Internet Name Service) allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed packets, which causes the server to slow down and fill the event logs with error messages.

Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size.

Bonk variation of teardrop IP fragmentation denial of service.

Buffer overflow in War FTP allows remote execution of commands.

Memory leak in Simple Network Management Protocol (SNMP) agent (snmp.exe) for Windows NT 4.0 before Service Pack 4 allows remote attackers to cause a denial of service (memory consumption) via a large number of SNMP packets with Object Identifiers (OIDs) that cannot be decoded.

Teardrop IP denial of service.

A later variation on the Teardrop IP denial of service attack, a.k.a. Teardrop-2.

Land IP denial of service.

The PATH in Windows NT includes the current working directory (.), which could allow local users to gain privileges by placing Trojan horse programs with the same name as commonly used system programs into certain directories.

Listening TCP ports are sequentially allocated, allowing spoofing attacks.

Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

Denial of service in Windows NT DNS servers by flooding port 53 with too many characters.

Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service.

A version of finger is running that exposes valid user information to any entity on the network.

Denial of service in RPCSS.EXE program (RPC Locator) in Windows NT.

Windows NT RSHSVC program allows remote users to execute arbitrary commands.

Denial of service in Windows NT DNS servers through malicious packet which contains a response to a query that wasn't made.