Microsoft Windows Server 2008 vulnerabilities

CVE-2024-21429 [MEDIUM] CWE-197 CVE-2024-21429: Windows USB Hub Driver Remote Code Execution Vulnerability Windows USB Hub Driver Remote Code Execution Vulnerability

CVE-2015-1637 [MEDIUM] CVE-2015-1637: Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Serve Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT

CVE-2023-32050 [HIGH] CWE-59 CVE-2023-32050: Windows Installer Elevation of Privilege Vulnerability Windows Installer Elevation of Privilege Vulnerability

CVE-2024-21405 [HIGH] CWE-591 CVE-2024-21405: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2023-35629 [MEDIUM] CWE-125 CVE-2023-35629: Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability

CVE-2024-38214 [MEDIUM] CWE-125 CVE-2024-38214: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

CVE-2019-0986 [MEDIUM] CWE-59 CVE-2019-0986: An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) impro An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a spe

CVE-2023-24861 [HIGH] CWE-367 CVE-2023-24861: Windows Graphics Component Elevation of Privilege Vulnerability Windows Graphics Component Elevation of Privilege Vulnerability

CVE-2024-26252 [MEDIUM] CWE-822 CVE-2024-26252: Windows rndismp6.sys Remote Code Execution Vulnerability Windows rndismp6.sys Remote Code Execution Vulnerability

CVE-2024-26253 [MEDIUM] CWE-20 CVE-2024-26253: Windows rndismp6.sys Remote Code Execution Vulnerability Windows rndismp6.sys Remote Code Execution Vulnerability

CVE-2023-21694 [MEDIUM] CWE-122 CVE-2023-21694: Windows Fax Service Remote Code Execution Vulnerability Windows Fax Service Remote Code Execution Vulnerability

CVE-2025-49743 [MEDIUM] CWE-362 CVE-2025-49743: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

CVE-2017-8587 [MEDIUM] CVE-2017-8587: Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2 Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511 allows a denial of service vulnerability when it attempts to open a non-existent file, aka "Windows Explorer Denial of Service Vulnerability".

CVE-2022-21925 [MEDIUM] CVE-2022-21925: Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability

CVE-2014-6318 [MEDIUM] CWE-287 CVE-2014-6318: The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Ser The audit logon feature in Remote Desktop Protocol (RDP) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly log unauthorized login attempts supplying valid credentials, which makes it easier for remote attackers to byp

CVE-2011-0091 [MEDIUM] CWE-287 CVE-2011-0091: Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption, which allows man-in-the-middle attackers to spoof network traffic and obtain sensitive information via a DES downgrade, aka "Kerberos Spoofing Vulnerability."

CVE-2025-53148 [MEDIUM] CWE-908 CVE-2025-53148: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

CVE-2025-50157 [MEDIUM] CWE-908 CVE-2025-50157: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

CVE-2025-53138 [MEDIUM] CWE-908 CVE-2025-53138: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

CVE-2025-53153 [MEDIUM] CWE-908 CVE-2025-53153: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authoriz Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.