Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2008

33 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-6339
    30Monitor

    The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force t

    MediumCVSS 6.8No exploitEPSS 10%

    akamai technologies · download managerMay 1, 2008

  • CVE-2008-2044
    33Monitor

    includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean li

    HighCVSS 7.5Proof of conceptEPSS 11%

    netoffice · dwinsMay 1, 2008

  • CVE-2008-2069
    47Plan

    Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    novell · groupwiseMay 2, 2008

  • CVE-2008-0599
    42Plan

    The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating th

    CriticalCVSS 9.8No exploitEPSS 10%

    php · phpMay 5, 2008

  • CVE-2008-2005
    25Monitor

    The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attacke

    MediumCVSS 5.0Proof of conceptEPSS 16%

    wonderware · intouchMay 6, 2008

  • CVE-2008-1801
    41Plan

    Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and po

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    rdesktop · rdesktopMay 12, 2008

  • CVE-2008-1802
    41Plan

    Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remot

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    rdesktop · rdesktopMay 12, 2008

  • CVE-2008-2138
    25Monitor

    Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav

    MediumCVSS 5.0Proof of conceptEPSS 15%

    oracle · application server portalMay 12, 2008

  • CVE-2008-2144
    45Plan

    Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of servi

    CriticalCVSS 10.0No exploitEPSS 16%

    sun · sunosMay 12, 2008

  • CVE-2008-2160
    42Plan

    Multiple unspecified vulnerabilities in the JPEG (GDI+) and GIF image processing in Microsoft Windows CE 5.0 allow remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · windows embedded compactMay 12, 2008

  • CVE-2008-2161
    60This week

    Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via

    CriticalCVSS 10.0WeaponizedEPSS 65%

    tftp · tftp server spMay 12, 2008

  • CVE-2008-0166
    51Plan

    OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable

    HighCVSS 7.5Proof of conceptEPSS 70%

    openssl · opensslMay 13, 2008

  • CVE-2008-2167
    22Monitor

    Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer

    MediumCVSS 4.3Proof of conceptEPSS 16%

    zyxel · zywall 100May 13, 2008

  • CVE-2008-2168
    33Monitor

    Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-

    MediumCVSS 4.3Proof of conceptEPSS 54%

    apache · http serverMay 13, 2008

  • CVE-2008-0119
    46Plan

    Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attacke

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeMay 13, 2008

  • CVE-2008-1091
    49Plan

    Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remot

    CriticalCVSS 9.3No exploitEPSS 40%

    microsoft · officeMay 13, 2008

  • CVE-2008-1434
    46Plan

    Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows re

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeMay 13, 2008

  • CVE-2008-1437
    24Monitor

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft pro

    MediumCVSS 5.0No exploitEPSS 12%

    microsoft · antigen for exchangeMay 13, 2008

  • CVE-2008-1438
    24Monitor

    Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft pro

    MediumCVSS 5.0No exploitEPSS 12%

    microsoft · antigen for exchangeMay 13, 2008

  • CVE-2008-2281
    44Plan

    Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote a

    CriticalCVSS 9.3Proof of conceptEPSS 23%

    microsoft · ieMay 18, 2008

  • CVE-2008-2286
    40Plan

    SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers t

    HighCVSS 7.5WeaponizedEPSS 32%

    symantec · altiris deployment solutionMay 18, 2008

  • CVE-2008-1104
    44Plan

    Stack-based buffer overflow in Foxit Reader before 2.3 build 2912 allows user-assisted remote attackers to execute arbitrary code via a craf

    CriticalCVSS 9.3No exploitEPSS 22%

    foxitsoftware · foxit readerMay 21, 2008

  • CVE-2008-1948
    44Plan

    The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly c

    CriticalCVSS 10.0No exploitEPSS 12%

    gnu · gnutlsMay 21, 2008

  • CVE-2008-2241
    44Plan

    Directory traversal vulnerability in caloggerd in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allows remote attackers to append arbit

    CriticalCVSS 10.0No exploitEPSS 11%

    ca · brightstor arcserve backupMay 21, 2008

  • CVE-2008-2242
    34Monitor

    Multiple buffer overflows in xdr functions in the server in CA BrightStor ARCServe Backup 11.0, 11.1, and 11.5 allow remote attackers to exe

    HighCVSS 7.5No exploitEPSS 14%

    ca · brightstor arcserve backupMay 21, 2008

  • CVE-2007-5962
    32Monitor

    Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresigh

    HighCVSS 7.1Proof of conceptEPSS 12%

    redhat · enterprise linuxMay 22, 2008

  • CVE-2008-2240
    59Plan

    Stack-based buffer overflow in the Web Server service in IBM Lotus Domino before 7.0.3 FP1, and 8.x before 8.0.1, allows remote attackers to

    CriticalCVSS 10.0WeaponizedEPSS 64%

    ibm · lotus dominoMay 22, 2008

  • CVE-2008-1767
    34Monitor

    Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly e

    HighCVSS 7.5Proof of conceptEPSS 12%

    redhat · desktopMay 23, 2008

  • CVE-2008-0955
    49Plan

    Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arb

    CriticalCVSS 9.3WeaponizedEPSS 41%

    creative · creative software autoupdate engineMay 29, 2008

  • CVE-2008-1105
    51Plan

    Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute a

    HighCVSS 7.5Proof of conceptEPSS 69%

    samba · sambaMay 29, 2008

  • CVE-2008-2157
    51Plan

    robotd in the Library Manager in EMC AlphaStor 3.1 SP1 for Windows allows remote attackers to execute arbitrary commands via an unspecified

    CriticalCVSS 10.0WeaponizedEPSS 35%

    emc corporation · alphastorMay 29, 2008

  • CVE-2008-2158
    58Plan

    Multiple stack-based buffer overflows in the Command Line Interface process in the Server Agent in EMC AlphaStor 3.1 SP1 for Windows allow r

    CriticalCVSS 10.0WeaponizedEPSS 58%

    emc corporation · alphastorMay 29, 2008

  • CVE-2008-2499
    53Plan

    Stack-based buffer overflow in the Community Services Multiplexer (aka MUX or StMux.exe) in IBM Lotus Sametime 7.5.1 CF1 and earlier, and 8.

    HighCVSS 7.5WeaponizedEPSS 77%

    ibm · lotus sametimeMay 29, 2008