Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2008

44 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-2511
    40Plan

    Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEventCli.dll in CA Int

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    ca · internet security suite plus 2008Jun 2, 2008

  • CVE-2008-1035
    20Monitor

    Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger me

    MediumCVSS 4.3Proof of conceptEPSS 10%

    apple · icalJun 3, 2008

  • CVE-2008-1661
    61This week

    Stack-based buffer overflow in DoubleTake.exe in HP StorageWorks Storage Mirroring (SWSM) before 4.5 SP2 allows remote attackers to execute

    CriticalCVSS 10.0WeaponizedEPSS 68%

    hp · storageworks storage mirroringJun 4, 2008

  • CVE-2008-2549
    33Monitor

    Adobe Acrobat Reader 8.1.2 and earlier, and before 7.1.1, allows remote attackers to cause a denial of service (application crash) and possi

    MediumCVSS 4.3Proof of conceptEPSS 52%

    adobe · acrobat readerJun 4, 2008

  • CVE-2007-5604
    34Monitor

    Buffer overflow in the ExtractCab function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support be

    HighCVSS 7.5Proof of conceptEPSS 11%

    hp · instant supportJun 4, 2008

  • CVE-2007-5606
    44Plan

    Buffer overflow in the MoveFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support befo

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · instant supportJun 4, 2008

  • CVE-2007-5607
    34Monitor

    Buffer overflow in the RegistryString function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Suppor

    HighCVSS 7.5Proof of conceptEPSS 12%

    hp · instant supportJun 4, 2008

  • CVE-2008-2402
    23Monitor

    The Admin Server in Sun Java Active Server Pages (ASP) Server before 4.0.3 stores sensitive information under the web root with insufficient

    MediumCVSS 5.0No exploitEPSS 11%

    sun · java asp serverJun 4, 2008

  • CVE-2008-2403
    46Plan

    Multiple directory traversal vulnerabilities in unspecified ASP applications in Sun Java Active Server Pages (ASP) Server before 4.0.3 allow

    CriticalCVSS 10.0No exploitEPSS 19%

    sun · java asp serverJun 4, 2008

  • CVE-2008-2541
    43Plan

    Multiple stack-based buffer overflows in the HTTP Gateway Service (icihttp.exe) in CA eTrust Secure Content Manager 8.0 allow remote attacke

    CriticalCVSS 10.0No exploitEPSS 10%

    ca · etrust secure content managerJun 4, 2008

  • CVE-2008-1770
    40Plan

    CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and exe

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    akamai · download managerJun 4, 2008

  • CVE-2008-2551
    51Plan

    The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and ex

    CriticalCVSS 9.3WeaponizedEPSS 46%

    icona · instant messengerJun 4, 2008

  • CVE-2008-2631
    27Monitor

    The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference

    MediumCVSS 5.0Proof of conceptEPSS 22%

    altn · mdaemonJun 9, 2008

  • CVE-2008-0960
    61This week

    SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) J

    CriticalCVSS 10.0Proof of conceptEPSS 68%

    net-snmp · net snmpJun 10, 2008

  • CVE-2008-2645
    42Plan

    Multiple PHP remote file inclusion vulnerabilities in Brim (formerly Booby) 1.0.1 allow remote attackers to execute arbitrary PHP code via a

    HighCVSS 7.5Proof of conceptEPSS 39%

    brim-project · brimJun 10, 2008

  • CVE-2008-2650
    33Monitor

    Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include

    MediumCVSS 6.8Proof of conceptEPSS 18%

    cmsimple · cmsimpleJun 10, 2008

  • CVE-2008-0011
    46Plan

    Microsoft DirectX 8.1 through 9.0c, and DirectX on Microsoft XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, d

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · windows-ntJun 11, 2008

  • CVE-2008-1440
    35Monitor

    Microsoft Windows XP SP2 and SP3, and Server 2003 SP1 and SP2, does not properly validate the option length field in Pragmatic General Multi

    HighCVSS 7.1No exploitEPSS 22%

    microsoft · windows server 2003Jun 11, 2008

  • CVE-2008-1441
    27Monitor

    Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of

    MediumCVSS 5.4No exploitEPSS 19%

    microsoft · windows server 2003Jun 11, 2008

  • CVE-2008-1442
    49Plan

    Heap-based buffer overflow in the substringData method in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3No exploitEPSS 38%

    microsoft · internet explorerJun 11, 2008

  • CVE-2008-1444
    49Plan

    Stack-based buffer overflow in Microsoft DirectX 7.0 and 8.1 on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a Syn

    CriticalCVSS 9.3No exploitEPSS 39%

    microsoft · windows-ntJun 11, 2008

  • CVE-2008-1445
    36Monitor

    Active Directory on Microsoft Windows 2000 Server SP4, XP Professional SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote a

    HighCVSS 7.1No exploitEPSS 27%

    microsoft · windows-ntJun 11, 2008

  • CVE-2008-2683
    47Plan

    The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to force the download and

    CriticalCVSS 9.3WeaponizedEPSS 34%

    black ice · barcode sdkJun 12, 2008

  • CVE-2008-2364
    24Monitor

    The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not

    MediumCVSS 5.0No exploitEPSS 12%

    apache · http serverJun 13, 2008

  • CVE-2008-2689
    54Plan

    PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arbitrary PHP code via

    CriticalCVSS 10.0Proof of conceptEPSS 46%

    browsercrm · browsercrmJun 13, 2008

  • CVE-2008-2693
    40Plan

    Stack-based buffer overflow in the BITIFF.BITiffCtrl.1 ActiveX control in BITiff.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote at

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    black ice · barcode sdkJun 13, 2008

  • CVE-2008-2702
    40Plan

    Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overw

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    estsoft · alftpJun 13, 2008

  • CVE-2008-2703
    58Plan

    Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows allow remote attackers to exe

    CriticalCVSS 10.0WeaponizedEPSS 61%

    novell · groupwise messengerJun 13, 2008

  • CVE-2008-2639
    53Plan

    Stack-based buffer overflow in the ODBC server service in Citect CitectSCADA 6 and 7, and CitectFacilities 7, allows remote attackers to exe

    HighCVSS 7.6WeaponizedEPSS 77%

    citect · citectfacilitiesJun 16, 2008

  • CVE-2008-2712
    42Plan

    Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properl

    CriticalCVSS 9.3Proof of conceptEPSS 15%

    vim · vimJun 16, 2008

  • CVE-2008-2719
    30Monitor

    Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of

    MediumCVSS 6.8Proof of conceptEPSS 10%

    nasm · netwide assemblerJun 16, 2008

  • CVE-2008-2745
    40Plan

    Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    black ice · annotation softwareJun 17, 2008

  • CVE-2008-2752
    36Monitor

    Microsoft Word 2000 9.0.2812 and 2003 11.8106.8172 does not properly handle unordered lists, which allows user-assisted remote attackers to

    HighCVSS 7.1Proof of conceptEPSS 27%

    microsoft · wordJun 18, 2008

  • CVE-2008-2666
    24Monitor

    Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by

    MediumCVSS 5.0Proof of conceptEPSS 13%

    php · phpJun 19, 2008

  • CVE-2008-2789
    40Plan

    SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands via the page_id parame

    HighCVSS 7.5WeaponizedEPSS 22%

    basic-cms · basic-cmsJun 20, 2008

  • CVE-2008-2427
    42Plan

    Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    freebsd · freebsdJun 24, 2008

  • CVE-2008-2832
    44Plan

    Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and ex

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    fullrevolution · aspwebcalendar2008Jun 24, 2008

  • CVE-2008-2841
    32Monitor

    Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute

    MediumCVSS 6.8Proof of conceptEPSS 15%

    xchat · xchatJun 24, 2008

  • CVE-2008-2641
    47Plan

    Unspecified vulnerability in Adobe Reader and Acrobat 7.0.9 and earlier, and 8.0 through 8.1.2, allows remote attackers to cause a denial of

    CriticalCVSS 10.0No exploitEPSS 23%

    adobe · acrobat 3dJun 25, 2008

  • CVE-2008-2905
    40Plan

    PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when registe

    MediumCVSS 6.8WeaponizedEPSS 18%

    mambo · mamboJun 30, 2008

  • CVE-2008-2908
    48Plan

    Multiple stack-based buffer overflows in a certain ActiveX control in ienipp.ocx in Novell iPrint Client for Windows before 4.36 allow remot

    CriticalCVSS 9.3WeaponizedEPSS 35%

    novell · iprint clientJun 30, 2008

  • CVE-2008-2947
    34Monitor

    Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from o

    MediumCVSS 6.8No exploitEPSS 24%

    microsoft · internet explorerJun 30, 2008

  • CVE-2008-2948
    35Monitor

    Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the

    MediumCVSS 6.8Proof of conceptEPSS 25%

    microsoft · internet explorerJun 30, 2008

  • CVE-2008-2949
    33Monitor

    Cross-domain vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to change the location property of a frame via the

    MediumCVSS 6.8Proof of conceptEPSS 20%

    microsoft · internet explorerJun 30, 2008