Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2008

56 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-6613
    24Monitor

    Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library

    MediumCVSS 5.0Proof of conceptEPSS 12%

    gnu · libcdioJan 3, 2008

  • CVE-2007-6638
    44Plan

    March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to o

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    march networks · 3204 dvrJan 3, 2008

  • CVE-2008-0090
    27Monitor

    A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 cra

    MediumCVSS 5.0Proof of conceptEPSS 22%

    divx · divx playerJan 3, 2008

  • CVE-2008-0095
    28Monitor

    The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance

    MediumCVSS 5.0Proof of conceptEPSS 25%

    asterisk · asterisk appliance developer kitJan 7, 2008

  • CVE-2007-6388
    40Plan

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 throu

    MediumCVSS 4.3No exploitEPSS 75%

    apache · http serverJan 8, 2008

  • CVE-2008-0139
    34Monitor

    Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP co

    MediumCVSS 6.8Proof of conceptEPSS 22%

    loudblog · loudblogJan 8, 2008

  • CVE-2008-0144
    43Plan

    PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via

    HighCVSS 7.5Proof of conceptEPSS 44%

    phprisk · netriskJan 8, 2008

  • CVE-2007-0066
    37Monitor

    The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attac

    HighCVSS 7.1No exploitEPSS 31%

    microsoft · home serverJan 8, 2008

  • CVE-2007-0069
    52Plan

    Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of ser

    CriticalCVSS 9.3No exploitEPSS 49%

    microsoft · windows 2003 serverJan 8, 2008

  • CVE-2007-5360
    35Monitor

    Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWa

    HighCVSS 7.5No exploitEPSS 15%

    openpegasus · management serverJan 8, 2008

  • CVE-2008-0153
    24Monitor

    telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) vi

    MediumCVSS 5.0Proof of conceptEPSS 13%

    pragma systems · pragma telnetserverJan 8, 2008

  • CVE-2007-6250
    45Plan

    Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might

    CriticalCVSS 9.3No exploitEPSS 25%

    aol · aolmediaplaybackcontrolJan 9, 2008

  • CVE-2008-0220
    35Monitor

    Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gatewa

    HighCVSS 7.5Proof of conceptEPSS 15%

    gateway · cweblaunchctl activex controlJan 10, 2008

  • CVE-2008-0225
    29Monitor

    Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to e

    MediumCVSS 6.4Proof of conceptEPSS 14%

    xine · xine-libJan 10, 2008

  • CVE-2008-0226
    57Plan

    Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitr

    HighCVSS 7.5WeaponizedEPSS 91%

    yassl · yasslJan 10, 2008

  • CVE-2008-0234
    41Plan

    Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    apple · quicktimeJan 10, 2008

  • CVE-2008-0235
    49Plan

    The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.

    CriticalCVSS 10.0No exploitEPSS 29%

    microsoft · vfp ole server activex controlJan 10, 2008

  • CVE-2008-0236
    28Monitor

    An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary commands by invoking the

    MediumCVSS 5.8Proof of conceptEPSS 17%

    microsoft · visual foxproJan 10, 2008

  • CVE-2008-0237
    33Monitor

    The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the in

    MediumCVSS 6.8Proof of conceptEPSS 20%

    microsoft · rich textbox controlJan 10, 2008

  • CVE-2008-0005
    21Monitor

    mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows

    MediumCVSS 4.3No exploitEPSS 14%

    apache · http serverJan 11, 2008

  • CVE-2008-0244
    64This week

    SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec

    CriticalCVSS 10.0WeaponizedEPSS 80%

    sap · maxdbJan 11, 2008

  • CVE-2008-0248
    40Plan

    Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    streamaudio · chaincast proxymanager activex controlJan 11, 2008

  • CVE-2008-0250
    42Plan

    Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN)

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    microsoft · visual interdevJan 11, 2008

  • CVE-2008-0122
    44Plan

    Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEAS

    CriticalCVSS 10.0No exploitEPSS 12%

    isc · bindJan 15, 2008

  • CVE-2008-0295
    37Monitor

    Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlie

    HighCVSS 8.5Proof of conceptEPSS 11%

    videolan · vlc media playerJan 16, 2008

  • CVE-2008-0296
    44Plan

    Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RT

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    videolan · vlc media playerJan 16, 2008

  • CVE-2008-0081
    56Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote att

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    microsoft · excelJan 16, 2008

  • CVE-2007-6681
    35Monitor

    Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long

    HighCVSS 7.5Proof of conceptEPSS 17%

    videolan · vlcJan 16, 2008

  • CVE-2007-6682
    35Monitor

    Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute a

    HighCVSS 7.5Proof of conceptEPSS 15%

    videolan · vlcJan 16, 2008

  • CVE-2008-0027
    57Plan

    Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (C

    CriticalCVSS 10.0No exploitEPSS 57%

    cisco · unified callmanagerJan 16, 2008

  • CVE-2008-0333
    23Monitor

    Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers

    MediumCVSS 5.0Proof of conceptEPSS 11%

    afterlogic · mailbee webmail proJan 17, 2008

  • CVE-2008-0339
    44Plan

    Unspecified vulnerability in the XML DB component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 has unknown impact and remot

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    oracle · database serverJan 17, 2008

  • CVE-2008-0352
    34Monitor

    The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly in

    HighCVSS 7.8Proof of conceptEPSS 10%

    linux · linux kernelJan 17, 2008

  • CVE-2008-0356
    62This week

    Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 a

    CriticalCVSS 10.0No exploitEPSS 72%

    citrix · access essentialsJan 18, 2008

  • CVE-2008-0065
    58Plan

    Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a lon

    CriticalCVSS 10.0WeaponizedEPSS 61%

    winamp · nullsoft winampJan 22, 2008

  • CVE-2008-0376
    36Monitor

    PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code v

    MediumCVSS 6.8Proof of conceptEPSS 31%

    softpedia · small axe weblogJan 22, 2008

  • CVE-2008-0380
    44Plan

    Buffer overflow in the Digital Data Communications RtspVaPgCtrl ActiveX control (RtspVapgDecoder.dll 1.1.0.29) allows remote attackers to ex

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    digital data communications · rtspvapgdecoder.dllJan 22, 2008

  • CVE-2008-0382
    43Plan

    Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter

    HighCVSS 7.5Proof of conceptEPSS 41%

    mybulletinboard · mybulletinboardJan 22, 2008

  • CVE-2008-0128
    26Monitor

    The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the

    MediumCVSS 5.0Proof of conceptEPSS 19%

    apache · tomcatJan 22, 2008

  • CVE-2008-0392
    46Plan

    Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary cod

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    microsoft · visual basicJan 22, 2008

  • CVE-2008-0394
    34Monitor

    Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which

    HighCVSS 7.5Proof of conceptEPSS 11%

    citadel · smtpJan 23, 2008

  • CVE-2008-0423
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY

    MediumCVSS 6.8Proof of conceptEPSS 37%

    lama · lama softwareJan 23, 2008

  • CVE-2008-0434
    40Plan

    Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    gecad technologies · axigen mail serverJan 23, 2008

  • CVE-2008-0437
    57Plan

    Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installat

    CriticalCVSS 10.0Proof of conceptEPSS 58%

    hp · virtual roomsJan 23, 2008

  • CVE-2008-0443
    44Plan

    Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    lycos · fileuploader.dllJan 24, 2008

  • CVE-2008-0454
    45Plan

    Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windowsJan 24, 2008

  • CVE-2008-0455
    36Monitor

    Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.

    MediumCVSS 4.3Proof of conceptEPSS 64%

    apache · http serverJan 24, 2008

  • CVE-2008-0456
    16Monitor

    CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earli

    LowCVSS 2.6No exploitEPSS 19%

    apache · http serverJan 24, 2008

  • CVE-2008-0460
    21Monitor

    Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8

    MediumCVSS 4.3No exploitEPSS 14%

    mediawiki · mediawikiJan 25, 2008

  • CVE-2008-0175
    35Monitor

    Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute a

    HighCVSS 7.5Proof of conceptEPSS 15%

    ge fanuc · proficy real-time information portalJan 28, 2008

  • CVE-2008-0387
    45Plan

    Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote at

    HighCVSS 7.8Proof of conceptEPSS 45%

    firebirdsql · firebirdJan 28, 2008

  • CVE-2008-0470
    46Plan

    A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    comodo · comodo antivirusJan 29, 2008

  • CVE-2008-0477
    44Plan

    Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows re

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    move networks inc · move media playerJan 29, 2008

  • CVE-2008-0492
    40Plan

    Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote

    MediumCVSS 6.8WeaponizedEPSS 29%

    persits · xuploadJan 30, 2008

  • CVE-2008-0503
    34Monitor

    Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via

    MediumCVSS 6.8Proof of conceptEPSS 23%

    netwerk · smart publisherJan 31, 2008

  • CVE-2008-0506
    45Plan

    include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configure

    MediumCVSS 6.8WeaponizedEPSS 58%

    coppermine · coppermine photo galleryJan 31, 2008