Microsoft Windows 95 vulnerabilities

46 CVEs affecting Microsoft Windows 95, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-1999-1593, published 2009-01-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-1999-0016, published 1997-12-01. Medium severity, CVSS 5.0. EPSS: 95.7% chance of exploitation in the next 30 days. Land IP denial of service.
CVE-2000-0979, published 2000-12-19. Medium severity, CVSS 6.4. EPSS: 75.1% chance of exploitation in the next 30 days. File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by…
CVE-1999-0256, published 1998-02-01. High severity, CVSS 7.5. EPSS: 72.9% chance of exploitation in the next 30 days. Buffer overflow in War FTP allows remote execution of commands.
CVE-2000-1039, published 2001-01-09. Medium severity, CVSS 5.0. EPSS: 45.8% chance of exploitation in the next 30 days. Various TCP/IP stacks and network applications allow remote attackers to cause a denial of service by flooding a target host with TCP connection attempts and completing the TCP/IP handshake without…
CVE-2000-0305, published 2000-05-19. High severity, CVSS 7.8. EPSS: 38.4% chance of exploitation in the next 30 days. Windows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a large number of identical fragmented IP packets,…
CVE-1999-0015, published 1997-12-16. Medium severity, CVSS 5.0. EPSS: 35.4% chance of exploitation in the next 30 days. Teardrop IP denial of service.
CVE-2002-0053, published 2002-03-08. High severity, CVSS 7.5. EPSS: 35% chance of exploitation in the next 30 days. Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a…
CVE-1999-0918, published 1999-07-03. High severity, CVSS 7.8. EPSS: 26.4% chance of exploitation in the next 30 days. Denial of service in various Windows systems via malformed, fragmented IGMP packets.
CVE-1999-1105, published 1999-12-31. Medium severity, CVSS 5.0. EPSS: 21.6% chance of exploitation in the next 30 days. Windows 95, when Remote Administration and File Sharing for NetWare Networks is enabled, creates a share (C$) when an administrator logs in remotely, which allows remote attackers to read arbitrary…
CVE-1999-0153, published 1997-07-01. Medium severity, CVSS 5.0. EPSS: 21.1% chance of exploitation in the next 30 days. Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke.

Latest

CVE-1999-1593, published 2009-01-15. High severity, CVSS 7.6. EPSS: 18.1% chance of exploitation in the next 30 days. Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain…
CVE-2005-2388, published 2005-07-27. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.
CVE-2002-1692, published 2002-12-31. Low severity, CVSS 3.6. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in backup utility of Microsoft Windows 95 allows attackers to execute arbitrary code by causing a filename with a long extension to be placed in a folder to be backed up.
CVE-2002-1325, published 2002-12-23. Medium severity, CVSS 5.0. EPSS: 13.9% chance of exploitation in the next 30 days. Microsoft Virtual Machine (VM) build 5.0.3805 and earlier allows remote attackers to determine a local user's username via a Java applet that accesses the user.dir system property, aka "User.dir…
CVE-2002-1260, published 2002-12-23. High severity, CVSS 7.5. EPSS: 15.5% chance of exploitation in the next 30 days. The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java…
CVE-2002-1258, published 2002-12-23. Medium severity, CVSS 5.0. EPSS: 15.3% chance of exploitation in the next 30 days. Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet…
CVE-2002-1257, published 2002-12-23. High severity, CVSS 10.0. EPSS: 15.3% chance of exploitation in the next 30 days. Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to execute arbitrary code by including a Java applet that invokes COM (Component Object Model) objects in a…
CVE-2001-0238, published 2001-07-02. High severity, CVSS 7.5. EPSS: 14.8% chance of exploitation in the next 30 days. Microsoft Data Access Component Internet Publishing Provider 8.103.2519.0 and earlier allows remote attackers to bypass Security Zone restrictions via WebDAV requests.