Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2008

46 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-1609
    40Plan

    Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to execute arbitrary P

    MediumCVSS 6.8Proof of conceptEPSS 44%

    jaf cms · jaf cmsApr 1, 2008

  • CVE-2008-1610
    46Plan

    Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service or execute arbitrary

    HighCVSS 7.5WeaponizedEPSS 53%

    tallsoft quick · tftp server proApr 1, 2008

  • CVE-2008-1611
    60This week

    Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or execute arbitrary code

    CriticalCVSS 10.0WeaponizedEPSS 67%

    tftp-server · winagents tftp serverApr 1, 2008

  • CVE-2008-1682
    35Monitor

    PHP remote file inclusion vulnerability in quiz/common/db_config.inc.php in the Online FlashQuiz (com_onlineflashquiz) 1.0.2 component for J

    MediumCVSS 6.8Proof of conceptEPSS 26%

    elearningforce · online flashquizApr 4, 2008

  • CVE-2008-0311
    46Plan

    Stack-based buffer overflow in the PGMWebHandler::parse_request function in the StarTeam Multicast Service component (STMulticastService) 6.

    CriticalCVSS 9.3WeaponizedEPSS 31%

    borland · caliberrmApr 6, 2008

  • CVE-2008-1602
    60This week

    Stack-based buffer overflow in Orbit downloader 2.6.3 and 2.6.4 allows remote attackers to execute arbitrary code via a long download URL, w

    CriticalCVSS 10.0WeaponizedEPSS 67%

    orbit downloader · orbit downloaderApr 6, 2008

  • CVE-2007-4620
    52Plan

    Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0

    CriticalCVSS 9.0WeaponizedEPSS 52%

    ca · brightstor arcserve backupApr 7, 2008

  • CVE-2008-1328
    44Plan

    Buffer overflow in the LGServer service in CA ARCserve Backup for Laptops and Desktops r11.0 through r11.5, and Suite 11.1 and 11.2, allows

    CriticalCVSS 9.3No exploitEPSS 23%

    broadcom · desktop management suiteApr 7, 2008

  • CVE-2008-1697
    62This week

    Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to

    CriticalCVSS 10.0WeaponizedEPSS 74%

    hp · openview network node managerApr 8, 2008

  • CVE-2008-0083
    46Plan

    The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2,

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · windows 2000Apr 8, 2008

  • CVE-2008-0087
    40Plan

    The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows

    HighCVSS 7.5No exploitEPSS 32%

    microsoft · windows 2000Apr 8, 2008

  • CVE-2008-1083
    49Plan

    Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vi

    HighCVSS 8.1Proof of conceptEPSS 56%

    microsoft · windows 2000Apr 8, 2008

  • CVE-2008-1085
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 through SP1, and 7 allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · ieApr 8, 2008

  • CVE-2008-1086
    46Plan

    The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows 2000Apr 8, 2008

  • CVE-2008-1087
    54Plan

    Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote atta

    CriticalCVSS 9.3Proof of conceptEPSS 56%

    microsoft · windows-ntApr 8, 2008

  • CVE-2008-1088
    47Plan

    Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a craft

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · projectApr 8, 2008

  • CVE-2008-1089
    47Plan

    Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeApr 8, 2008

  • CVE-2008-1090
    47Plan

    Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeApr 8, 2008

  • CVE-2008-1709
    41Plan

    Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN)

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    microsoft · visual interdevApr 9, 2008

  • CVE-2007-0071
    65This week

    Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code vi

    CriticalCVSS 9.3No exploitEPSS 92%

    adobe · flash playerApr 9, 2008

  • CVE-2007-6019
    55Plan

    Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a

    CriticalCVSS 9.3Proof of conceptEPSS 59%

    adobe · airApr 9, 2008

  • CVE-2008-1721
    37Monitor

    Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a ne

    HighCVSS 7.5Proof of conceptEPSS 22%

    python · pythonApr 10, 2008

  • CVE-2008-1724
    48Plan

    Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1

    CriticalCVSS 9.3WeaponizedEPSS 35%

    tumbleweed · securetransport serverApr 11, 2008

  • CVE-2008-0927
    41Plan

    dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTT

    MediumCVSS 5.0Proof of conceptEPSS 70%

    novell · edirectoryApr 14, 2008

  • CVE-2008-1100
    43Plan

    Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbit

    CriticalCVSS 10.0No exploitEPSS 10%

    clam anti-virus · clamavApr 14, 2008

  • CVE-2008-1773
    35Monitor

    PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via

    MediumCVSS 6.8Proof of conceptEPSS 26%

    dragoon · dragoonApr 14, 2008

  • CVE-2008-1776
    35Monitor

    PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute ar

    MediumCVSS 6.8Proof of conceptEPSS 26%

    phpblock · phpblockApr 14, 2008

  • CVE-2008-1842
    44Plan

    Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to c

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    hp · openview network node managerApr 16, 2008

  • CVE-2008-0892
    40Plan

    The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and E

    CriticalCVSS 9.0No exploitEPSS 14%

    redhat · directory serverApr 16, 2008

  • CVE-2008-0320
    54Plan

    Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and

    CriticalCVSS 9.3WeaponizedEPSS 56%

    openoffice · openoffice.orgApr 17, 2008

  • CVE-2008-1876
    35Monitor

    PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in t

    MediumCVSS 6.8Proof of conceptEPSS 27%

    snarky · visualpicApr 17, 2008

  • CVE-2008-1878
    35Monitor

    Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote at

    HighCVSS 7.5Proof of conceptEPSS 15%

    xine · xine-libApr 17, 2008

  • CVE-2008-1881
    31Monitor

    Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary c

    MediumCVSS 6.8Proof of conceptEPSS 11%

    videolan · vlcApr 17, 2008

  • CVE-2008-1436
    47Plan

    Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2)

    CriticalCVSS 9.0Proof of conceptEPSS 36%

    microsoft · windows-ntApr 21, 2008

  • CVE-2008-1898
    53Plan

    A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote

    CriticalCVSS 9.3WeaponizedEPSS 52%

    microsoft · officeApr 21, 2008

  • CVE-2008-1903
    42Plan

    PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote a

    HighCVSS 7.5Proof of conceptEPSS 39%

    newanz · newsofficeApr 22, 2008

  • CVE-2008-1912
    41Plan

    Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause a denial of service

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    divx · divx playerApr 22, 2008

  • CVE-2008-1914
    62This week

    Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to e

    CriticalCVSS 10.0WeaponizedEPSS 73%

    bigantsoft · bigant messengerApr 22, 2008

  • CVE-2007-6255
    46Plan

    Buffer overflow in the Microsoft HeartbeatCtl ActiveX control in HRTBEAT.OCX allows remote attackers to execute arbitrary code via the Host

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows 2000Apr 23, 2008

  • CVE-2008-1765
    43Plan

    Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remote attackers and phys

    CriticalCVSS 9.3Proof of conceptEPSS 19%

    adobe · photoshopApr 23, 2008

  • CVE-2008-1933
    21Monitor

    Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary file

    MediumCVSS 4.3Proof of conceptEPSS 13%

    microsoft · zune softwareApr 25, 2008

  • CVE-2008-1963
    42Plan

    PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbi

    HighCVSS 7.5Proof of conceptEPSS 39%

    quate · grape web statisticsApr 25, 2008

  • CVE-2008-1965
    40Plan

    Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used b

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    ibm · lotus expeditor clientApr 25, 2008

  • CVE-2008-1996
    23Monitor

    licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number

    MediumCVSS 5.0Proof of conceptEPSS 11%

    licq · licqApr 28, 2008

  • CVE-2008-2031
    40Plan

    VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereferen

    MediumCVSS 5.0WeaponizedEPSS 46%

    vicftps · vicftpsApr 30, 2008

  • CVE-2008-2040
    34Monitor

    Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote

    HighCVSS 7.5Proof of conceptEPSS 14%

    peercast · peercastApr 30, 2008