| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A Windows NT system does not clear the system page file during shutdown, which might allow sensitive information to be recorded. |
| The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in. |
| A Windows NT system's registry audit policy does not log an event success or failure for non-critical registry keys. |
| A Windows NT system's registry audit policy does not log an event success or failure for security-critical registry keys. |
| A Windows NT system's file audit policy does not log an event success or failure for non-critical files or directories. |
| A Windows NT system's file audit policy does not log an event success or failure for security-critical files or directories. |
| .reg files are associated with the Windows NT registry editor (regedit), making the registry susceptible to Trojan Horse attacks. |
| Windows NT is not using a password filter utility, e.g. PASSFILT.DLL. |
| The registry in Windows NT can be accessed remotely by users who are not administrators. |
| A system-critical Windows NT file or directory has inappropriate permissions. |
| Denial of service in Windows NT messenger service through a long username. |
| A NETBIOS/SMB share password is the default, null, or missing. |
| A NETBIOS/SMB share password is guessable. |
| IP forwarding is enabled on a machine which is not a router or firewall. |
| Windows NT 4.0 beta allows users to read and delete shares. |
| Internet Explorer 4.0 and 5.0 allows a remote attacker to execute security scripts in a different security context using malicious URLs, a variant of the "cross frame" vulnerability. |
| Land IP denial of service. |
| The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files. |
| In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe). |
| IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request. |
