CreateProcess() is used insecurely on external application execution.
vulners.com/securityvulns/securityvulns:doc:10251
vulners.com/securityvulns/securityvulns:doc:10252