Windows management API privilege escalation with SetWindowLong()/SetWindowLongPtr() shatter attack, Virtual DOS Machine privilege escalation, EMF/WMF files code execution, DoS.
vulners.com/securityvulns/securityvulns:doc:6977
vulners.com/securityvulns/securityvulns:doc:6990
vulners.com/securityvulns/securityvulns:doc:6998
vulners.com/securityvulns/securityvulns:doc:7039