Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2008

51 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-1116
    40Plan

    Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner allows remote attackers

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    rising antivirus international · rising web scan objectMar 3, 2008

  • CVE-2008-1124
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary P

    MediumCVSS 6.8Proof of conceptEPSS 21%

    podcast generator · podcast generatorMar 3, 2008

  • CVE-2008-1126
    34Monitor

    PHP remote file inclusion vulnerability in main.php in Barryvan Compo Manager 0.3 allows remote attackers to execute arbitrary PHP code via

    MediumCVSS 6.8Proof of conceptEPSS 23%

    barryvan compo · barryvan compo managerMar 3, 2008

  • CVE-2008-1145
    28Monitor

    Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems

    MediumCVSS 5.0Proof of conceptEPSS 27%

    ruby-lang · webrickMar 4, 2008

  • CVE-2008-1188
    41Plan

    Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and

    CriticalCVSS 9.3No exploitEPSS 12%

    sun · jdkMar 6, 2008

  • CVE-2008-1190
    42Plan

    Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and e

    CriticalCVSS 9.3No exploitEPSS 16%

    sun · jdkMar 6, 2008

  • CVE-2008-1193
    41Plan

    Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    sun · jdkMar 6, 2008

  • CVE-2008-1200
    41Plan

    Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possi

    CriticalCVSS 9.3No exploitEPSS 11%

    microsoft · accessMar 6, 2008

  • CVE-2008-1270
    24Monitor

    mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to rea

    MediumCVSS 5.0Proof of conceptEPSS 11%

    lighttpd · lighttpdMar 10, 2008

  • CVE-2007-1201
    46Plan

    Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute ar

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · biztalk serverMar 11, 2008

  • CVE-2008-0110
    47Plan

    Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote a

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeMar 11, 2008

  • CVE-2008-0111
    52Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-ass

    CriticalCVSS 9.3Proof of conceptEPSS 50%

    microsoft · excelMar 11, 2008

  • CVE-2008-0112
    47Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arb

    CriticalCVSS 9.3Proof of conceptEPSS 32%

    microsoft · excelMar 11, 2008

  • CVE-2008-0113
    50Plan

    Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code vi

    CriticalCVSS 9.3Proof of conceptEPSS 42%

    microsoft · excel viewerMar 11, 2008

  • CVE-2008-0114
    49Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office for Mac 2004 allows user-assisted remote att

    CriticalCVSS 9.3Proof of conceptEPSS 38%

    microsoft · excelMar 11, 2008

  • CVE-2008-0115
    49Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-ass

    CriticalCVSS 9.3Proof of conceptEPSS 39%

    microsoft · excelMar 11, 2008

  • CVE-2008-0116
    51Plan

    Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote att

    CriticalCVSS 9.3Proof of conceptEPSS 48%

    microsoft · excelMar 11, 2008

  • CVE-2008-0117
    47Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · compatibility pack word excel powerpoint 2007Mar 11, 2008

  • CVE-2008-0118
    47Plan

    Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-a

    CriticalCVSS 9.3Proof of conceptEPSS 34%

    microsoft · officeMar 11, 2008

  • CVE-2008-1203
    35Monitor

    The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for

    HighCVSS 7.5No exploitEPSS 15%

    adobe · coldfusionMar 11, 2008

  • CVE-2008-1307
    44Plan

    Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Online Update Module 200

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    kingsoft · antivirus online update moduleMar 12, 2008

  • CVE-2008-1309
    51Plan

    The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before

    CriticalCVSS 9.3WeaponizedEPSS 45%

    realnetworks · realplayerMar 12, 2008

  • CVE-2008-1311
    40Plan

    The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang)

    MediumCVSS 5.0WeaponizedEPSS 49%

    packettrap · pt360 tool suite proMar 12, 2008

  • CVE-2008-1320
    45Plan

    Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    asg · asg-sentryMar 13, 2008

  • CVE-2008-0532
    57Plan

    Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server

    CriticalCVSS 10.0Proof of conceptEPSS 57%

    cisco · acs for windowsMar 14, 2008

  • CVE-2008-0533
    26Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Sec

    MediumCVSS 4.3Proof of conceptEPSS 28%

    cisco · acs for windowsMar 14, 2008

  • CVE-2008-1117
    61This week

    Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows

    CriticalCVSS 10.0WeaponizedEPSS 69%

    netopia · timbuktu proMar 14, 2008

  • CVE-2008-1157
    46Plan

    Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen

    CriticalCVSS 10.0No exploitEPSS 20%

    cisco · ciscoworks internetwork performance monitorMar 14, 2008

  • CVE-2008-1358
    43Plan

    Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary co

    MediumCVSS 6.5WeaponizedEPSS 57%

    altn · mdaemonMar 17, 2008

  • CVE-2008-1365
    40Plan

    Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and e

    MediumCVSS 6.4WeaponizedEPSS 51%

    trend micro · officescan corporate editionMar 17, 2008

  • CVE-2008-1368
    20Monitor

    CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp://

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · internet explorerMar 17, 2008

  • CVE-2008-0062
    42Plan

    KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial

    CriticalCVSS 9.8No exploitEPSS 10%

    mit · kerberos 5Mar 19, 2008

  • CVE-2008-1405
    38Monitor

    PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code vi

    MediumCVSS 6.8Proof of conceptEPSS 37%

    fuzzylime · fuzzylimeMar 20, 2008

  • CVE-2008-1416
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in

    MediumCVSS 6.8Proof of conceptEPSS 37%

    phpauction · phpauction gplMar 20, 2008

  • CVE-2008-1201
    33Monitor

    Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows

    MediumCVSS 6.8No exploitEPSS 19%

    adobe · flashMar 24, 2008

  • CVE-2008-1289
    33Monitor

    Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Editi

    HighCVSS 7.5Proof of conceptEPSS 11%

    asterisk · asterisk appliance developer kitMar 24, 2008

  • CVE-2008-1461
    33Monitor

    Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command

    HighCVSS 7.6Proof of conceptEPSS 11%

    xnview · xnviewMar 24, 2008

  • CVE-2008-0951
    46Plan

    Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and po

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows vistaMar 24, 2008

  • CVE-2008-1472
    49Plan

    Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Ba

    CriticalCVSS 9.3WeaponizedEPSS 40%

    computer associates · brightstor arcserve backup laptops desktopsMar 24, 2008

  • CVE-2008-1160
    43Plan

    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows re

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    zyxel · zywall 1050 firmwareMar 24, 2008

  • CVE-2008-1489
    31Monitor

    Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) an

    MediumCVSS 6.8Proof of conceptEPSS 11%

    videolan · vlcMar 24, 2008

  • CVE-2008-1092
    45Plan

    Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a cr

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windows 2000Mar 25, 2008

  • CVE-2008-1491
    61This week

    Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows re

    CriticalCVSS 10.0WeaponizedEPSS 70%

    asus · remote consoleMar 25, 2008

  • CVE-2008-1502
    20Monitor

    The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and o

    MediumCVSS 4.3No exploitEPSS 10%

    egroupware · egroupwareMar 25, 2008

  • CVE-2008-1505
    44Plan

    PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote a

    HighCVSS 7.5Proof of conceptEPSS 46%

    joomla · joomlaMar 25, 2008

  • CVE-2008-1391
    36Monitor

    Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-depen

    HighCVSS 7.5Proof of conceptEPSS 18%

    freebsd · freebsdMar 27, 2008

  • CVE-2008-0926
    47Plan

    The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authenticatio

    HighCVSS 7.5WeaponizedEPSS 58%

    novell · edirectoryMar 28, 2008

  • CVE-2008-1544
    36Monitor

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request

    HighCVSS 7.1No exploitEPSS 26%

    microsoft · internet explorerMar 28, 2008

  • CVE-2008-1545
    21Monitor

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · internet explorerMar 28, 2008

  • CVE-2008-1558
    45Plan

    Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    mplayer · mplayerMar 31, 2008

  • CVE-2008-1562
    40Plan

    The LDAP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service (application

    MediumCVSS 5.0WeaponizedEPSS 50%

    wireshark · wiresharkMar 31, 2008