Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2008

59 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-6697
    33Monitor

    Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (app

    HighCVSS 7.5Proof of conceptEPSS 10%

    sdl · sdl imageFeb 1, 2008

  • CVE-2008-0550
    56Plan

    Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary co

    CriticalCVSS 10.0WeaponizedEPSS 53%

    radio toolbox · steamcastFeb 1, 2008

  • CVE-2008-0551
    46Plan

    The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 a

    CriticalCVSS 9.3Proof of conceptEPSS 29%

    sejoong namo · activesquareFeb 1, 2008

  • CVE-2008-0566
    34Monitor

    PHP remote file inclusion vulnerability in includes/smarty.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute

    MediumCVSS 6.8Proof of conceptEPSS 23%

    deltascripts · php linksFeb 4, 2008

  • CVE-2008-0567
    40Plan

    Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote

    HighCVSS 7.5Proof of conceptEPSS 34%

    chronoengine · chronoformsFeb 4, 2008

  • CVE-2008-0572
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP code via a URL in th

    MediumCVSS 6.8Proof of conceptEPSS 21%

    mindmeld · mindmeldFeb 4, 2008

  • CVE-2008-0590
    43Plan

    Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of service (crash) and possib

    CriticalCVSS 9.0Proof of conceptEPSS 22%

    progress · ws ftp serverFeb 5, 2008

  • CVE-2008-0610
    49Plan

    Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for Ul

    CriticalCVSS 9.3WeaponizedEPSS 38%

    ultravnc · ultravncFeb 6, 2008

  • CVE-2008-0619
    40Plan

    Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbitrary code or cause

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    nero · mediaplayerFeb 6, 2008

  • CVE-2008-0621
    52Plan

    Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary c

    HighCVSS 7.5WeaponizedEPSS 73%

    sap · sapguiFeb 6, 2008

  • CVE-2008-0635
    34Monitor

    Unspecified vulnerability in the delivery engine in Openads 2.4.0 through 2.4.2 allows remote attackers to execute arbitrary PHP code via un

    HighCVSS 7.5No exploitEPSS 12%

    openads · openadsFeb 6, 2008

  • CVE-2008-0457
    44Plan

    Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec B

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    symantec · backupexec system recoveryFeb 7, 2008

  • CVE-2008-0645
    40Plan

    Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL

    HighCVSS 7.5Proof of conceptEPSS 34%

    portail web php · portail web phpFeb 7, 2008

  • CVE-2008-0655
    76This week

    Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.

    HighCVSS 8.8KEVWeaponizedEPSS 37%

    adobe · acrobatFeb 7, 2008

  • CVE-2008-0177
    36Monitor

    The ipcomp6_input function in sys/netinet6/ipcomp_input.c in the KAME project before 20071201 does not properly check the return value of th

    HighCVSS 7.8Proof of conceptEPSS 15%

    kame · ipcompFeb 7, 2008

  • CVE-2008-0659
    57Plan

    Stack-based buffer overflow in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, as used in MySpace MySpaceUpl

    CriticalCVSS 10.0Proof of conceptEPSS 56%

    aurigma · image uploader activex controlFeb 7, 2008

  • CVE-2008-0660
    48Plan

    Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and

    CriticalCVSS 9.3Proof of conceptEPSS 37%

    aurigma · image uploader activex controlFeb 7, 2008

  • CVE-2007-5333
    39Monitor

    Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters

    MediumCVSS 5.0Proof of conceptEPSS 62%

    apache · tomcatFeb 11, 2008

  • CVE-2008-0671
    45Plan

    Stack-based buffer overflow in the add_line_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attackers to execute arbitr

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    tintin · tintin\+\+Feb 11, 2008

  • CVE-2007-5659
    87Now

    Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with

    HighCVSS 7.8KEVWeaponizedEPSS 87%

    adobe · acrobatFeb 12, 2008

  • CVE-2007-5663
    41Plan

    Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure J

    CriticalCVSS 9.3No exploitEPSS 13%

    adobe · acrobatFeb 12, 2008

  • CVE-2008-0726
    41Plan

    Integer overflow in Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via crafted arguments to th

    CriticalCVSS 9.3No exploitEPSS 14%

    adobe · acrobatFeb 12, 2008

  • CVE-2008-0075
    57Plan

    Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 through 6.0 allows remote attackers to execute arbitrary code

    CriticalCVSS 10.0No exploitEPSS 57%

    microsoft · internet information serverFeb 12, 2008

  • CVE-2008-0084
    53Plan

    Unspecified vulnerability in the TCP/IP support in Microsoft Windows Vista allows remote DHCP servers to cause a denial of service (hang and

    HighCVSS 7.8No exploitEPSS 73%

    microsoft · windows vistaFeb 12, 2008

  • CVE-2008-0088
    36Monitor

    Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM

    MediumCVSS 6.8No exploitEPSS 28%

    microsoft · windows 2000Feb 12, 2008

  • CVE-2007-0065
    53Plan

    Heap-based buffer overflow in Object Linking and Embedding (OLE) Automation in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2,

    CriticalCVSS 10.0No exploitEPSS 43%

    microsoft · windows 2000Feb 12, 2008

  • CVE-2007-0216
    48Plan

    wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2, Works 8.0, and Works Suite 2005, allows remote attackers to ex

    CriticalCVSS 9.3Proof of conceptEPSS 38%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0076
    46Plan

    Unspecified vulnerability in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attackers to execute arbitrary code via cr

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · ieFeb 12, 2008

  • CVE-2008-0077
    46Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by ass

    HighCVSS 8.8No exploitEPSS 37%

    microsoft · internet explorerFeb 12, 2008

  • CVE-2008-0078
    46Plan

    Unspecified vulnerability in an ActiveX control (dxtmsft.dll) in Microsoft Internet Explorer 5.01, 6 SP1 and SP2, and 7 allows remote attack

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · activexFeb 12, 2008

  • CVE-2008-0080
    52Plan

    Heap-based buffer overflow in the WebDAV Mini-Redirector in Microsoft Windows XP SP2, Server 2003 SP1 and SP2, and Vista allows remote attac

    CriticalCVSS 10.0No exploitEPSS 40%

    microsoft · windows 2003 serverFeb 12, 2008

  • CVE-2008-0102
    51Plan

    Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a cra

    CriticalCVSS 10.0No exploitEPSS 36%

    microsoft · publisherFeb 12, 2008

  • CVE-2008-0104
    46Plan

    Unspecified vulnerability in Microsoft Office Publisher 2000, 2002, and 2003 SP2 allows remote attackers to execute arbitrary code via a cra

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0105
    50Plan

    Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute ar

    CriticalCVSS 9.3Proof of conceptEPSS 43%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0108
    53Plan

    Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Su

    CriticalCVSS 9.3Proof of conceptEPSS 52%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0109
    46Plan

    Word in Microsoft Office 2000 SP3, XP SP3, Office 2003 SP2, and Office Word Viewer 2003 allows remote attackers to execute arbitrary code vi

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0103
    46Plan

    Unspecified vulnerability in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to e

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeFeb 12, 2008

  • CVE-2008-0748
    45Plan

    Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    sony · axruploadserver activex controlFeb 13, 2008

  • CVE-2007-6149
    44Plan

    Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allow

    CriticalCVSS 10.0No exploitEPSS 11%

    adobe · connect enterprise serverFeb 13, 2008

  • CVE-2008-0639
    47Plan

    Stack-based buffer overflow in the EnumPrinters function in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2, SP3, and SP4 for Wi

    CriticalCVSS 10.0No exploitEPSS 23%

    novell · clientFeb 13, 2008

  • CVE-2008-0782
    24Monitor

    Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 14%

    moinmoin · moinmoinFeb 14, 2008

  • CVE-2008-0803
    40Plan

    Multiple PHP remote file inclusion vulnerabilities in LookStrike Lan Manager 0.9 allow remote attackers to execute arbitrary PHP code via a

    HighCVSS 7.5Proof of conceptEPSS 32%

    lookstrike · lan managerFeb 15, 2008

  • CVE-2007-6258
    42Plan

    Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 41%

    apache · mod jkFeb 18, 2008

  • CVE-2008-0871
    40Plan

    Multiple stack-based buffer overflows in Now SMS/MMS Gateway 2007.06.27 and earlier allow remote attackers to execute arbitrary code via a (

    MediumCVSS 6.8WeaponizedEPSS 32%

    now · sms mms gatewayFeb 21, 2008

  • CVE-2008-0912
    45Plan

    Multiple heap-based buffer overflows in mlsrv10.exe in Sybase MobiLink 10.0.1.3629 and earlier, as used by SQL Anywhere Developer Edition 10

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    sybase · mobilinkFeb 22, 2008

  • CVE-2008-0935
    60This week

    Stack-based buffer overflow in the Novell iPrint Control ActiveX control in ienipp.ocx in Novell iPrint Client before 4.34 allows remote att

    CriticalCVSS 10.0WeaponizedEPSS 65%

    novell · iprintFeb 25, 2008

  • CVE-2008-0944
    23Monitor

    Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote attackers to cause a denial of service (NULL dereference and application c

    MediumCVSS 5.0Proof of conceptEPSS 11%

    ipswitch · instant messagingFeb 25, 2008

  • CVE-2008-0984
    42Plan

    The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrit

    CriticalCVSS 9.3Proof of conceptEPSS 15%

    miro · miro playerFeb 26, 2008

  • CVE-2008-1043
    45Plan

    PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BETA allows remote att

    HighCVSS 7.5Proof of conceptEPSS 48%

    linux web shop · php user baseFeb 27, 2008

  • CVE-2008-1046
    33Monitor

    PHP remote file inclusion vulnerability in footer.php in Quinsonnas Mail Checker 1.55 allows remote attackers to execute arbitrary PHP code

    MediumCVSS 6.8Proof of conceptEPSS 21%

    quinsonnas · quinsonnas mail checkerFeb 27, 2008

  • CVE-2008-1051
    33Monitor

    PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers to execute arbitrary

    MediumCVSS 6.8Proof of conceptEPSS 21%

    phpprofiles · phpprofiles Feb 27, 2008

  • CVE-2008-1059
    44Plan

    PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote a

    HighCVSS 7.5Proof of conceptEPSS 48%

    wordpress · sniplets pluginFeb 28, 2008

  • CVE-2008-1060
    43Plan

    Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 44%

    wordpress · sniplets pluginFeb 28, 2008

  • CVE-2008-0411
    31Monitor

    Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitr

    MediumCVSS 6.8Proof of conceptEPSS 14%

    ghostscript · ghostscriptFeb 28, 2008

  • CVE-2008-1067
    34Monitor

    Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the

    MediumCVSS 6.8Proof of conceptEPSS 21%

    phpqladmin · phpqladminFeb 28, 2008

  • CVE-2008-1069
    36Monitor

    Multiple PHP remote file inclusion vulnerabilities in Quantum Game Library 0.7.2c allow remote attackers to execute arbitrary PHP code via a

    MediumCVSS 6.8Proof of conceptEPSS 28%

    quantum game library · quantum game libraryFeb 28, 2008

  • CVE-2008-1074
    38Monitor

    PHP remote file inclusion vulnerability in lib/head_auth.php in GROUP-E 1.6.41 allows remote attackers to execute arbitrary PHP code via a U

    MediumCVSS 6.8Proof of conceptEPSS 36%

    group e · group eFeb 28, 2008

  • CVE-2007-6016
    52Plan

    Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the

    CriticalCVSS 9.3WeaponizedEPSS 50%

    symantec · backup exec for windows serverFeb 29, 2008

  • CVE-2008-1110
    30Monitor

    Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.10 allows remote atta

    MediumCVSS 6.8Proof of conceptEPSS 10%

    xine · xine-libFeb 29, 2008