> CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns.

Your own sources indicate CVE-2017-11882 was fixed in November of 2017. The title of the blob.0patch.com article is

> Did Microsoft Just Manually Patch Their Equation Editor Executable? Why Yes, Yes They Did. (CVE-2017-11882)

clearly indicating that Microsoft fixed the issue, contrary to your statement that they 'weren't actually fixed". The body content is consistent.

> NTLM relay attack

NTLM is bad, no question. It's based on a bad threat model - it assumes network admins can secure their corporate networks. Microsoft also fixed most of the issues in NTLM with NTLMv2 back in the Windows Vista and Windows 7 era. And Microsoft announced they will disable all NTLM versions by default within the Win11 lifetime. The biggest problem (unsurprisingly) is non-Microsoft software which has hardcoded the use of NTLM. It's fair to criticize Microsoft here for making available a technology that required so much from corporate network admins and leaving it available (and with use in Microsoft products) for so many years. At the same time, it's misleading to characterize these problems as "weren't actually fixed" - concrete issues with NTLM within its security model _were_ fixed and new technologies were created with better security models.

- https://techcommunity.microsoft.com/blog/windows-itpro-blog/...

> The link I gave you is the only disclosure/advisory page that Microsoft offers, don't blame me for them not offering a better UI. Ask them to do better.

You're mistaken. Microsoft has deep links for each CVE.

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...