Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2008

30 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-2952
    24Monitor

    liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER da

    MediumCVSS 5.0Proof of conceptEPSS 13%

    openldap · openldapJul 1, 2008

  • CVE-2008-2959
    44Plan

    Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might allow remote attackers

    CriticalCVSS 9.3Proof of conceptEPSS 24%

    microsoft · visual basic enterprise editionJul 2, 2008

  • CVE-2008-3023
    21Monitor

    Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.6.2 and earlier, and 3.6.3 dev3 and earlier development versions, when Internet

    MediumCVSS 4.3No exploitEPSS 11%

    fswiki · freestyle wikiJul 7, 2008

  • CVE-2008-2463
    45Plan

    The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Micro

    MediumCVSS 6.8WeaponizedEPSS 59%

    microsoft · office snapshot viewer activexJul 7, 2008

  • CVE-2008-2798
    44Plan

    Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow

    CriticalCVSS 10.0No exploitEPSS 13%

    mozilla · firefoxJul 7, 2008

  • CVE-2008-2950
    35Monitor

    The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Pa

    HighCVSS 7.5Proof of conceptEPSS 15%

    poppler · popplerJul 7, 2008

  • CVE-2008-3068
    35Monitor

    Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation Li

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · accessJul 7, 2008

  • CVE-2008-0085
    23Monitor

    SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engi

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · data engineJul 8, 2008

  • CVE-2008-0086
    55Plan

    Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSD

    CriticalCVSS 9.0No exploitEPSS 61%

    microsoft · data engineJul 8, 2008

  • CVE-2008-0106
    47Plan

    Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute

    CriticalCVSS 9.0No exploitEPSS 35%

    microsoft · data engineJul 8, 2008

  • CVE-2008-0107
    46Plan

    Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2,

    CriticalCVSS 9.0No exploitEPSS 34%

    microsoft · data engineJul 8, 2008

  • CVE-2008-1435
    46Plan

    Windows Explorer in Microsoft Windows Vista up to SP1, and Server 2008, allows user-assisted remote attackers to execute arbitrary code via

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · windows-ntJul 8, 2008

  • CVE-2008-1447
    60This week

    The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2

    MediumCVSS 6.8WeaponizedEPSS 95%

    microsoft · windows 2000Jul 8, 2008

  • CVE-2008-1454
    47Plan

    Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct

    CriticalCVSS 9.4No exploitEPSS 34%

    microsoft · windows 2000Jul 8, 2008

  • CVE-2008-2247
    24Monitor

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrar

    MediumCVSS 4.3No exploitEPSS 24%

    microsoft · exchange serverJul 8, 2008

  • CVE-2008-2248
    24Monitor

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrar

    MediumCVSS 4.3No exploitEPSS 24%

    microsoft · exchange serverJul 8, 2008

  • CVE-2008-2991
    29Monitor

    Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via

    MediumCVSS 6.1No exploitEPSS 16%

    adobe · robohelp serverJul 9, 2008

  • CVE-2008-2244
    47Plan

    Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · office wordJul 9, 2008

  • CVE-2008-3112
    48Plan

    Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE

    CriticalCVSS 10.0No exploitEPSS 25%

    sun · jdkJul 9, 2008

  • CVE-2008-3158
    40Plan

    Unspecified vulnerability in NWFS.SYS in Novell Client for Windows 4.91 SP4 has unknown impact and attack vectors, possibly related to IOCTL

    MediumCVSS 6.9WeaponizedEPSS 5%

    novell · novell client for windowsJul 11, 2008

  • CVE-2008-2303
    44Plan

    Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    apple · iphoneJul 14, 2008

  • CVE-2008-3173
    30Monitor

    Microsoft Internet Explorer allows web sites to set cookies for domains that have a public suffix with more than one dot character, which co

    MediumCVSS 6.8No exploitEPSS 11%

    microsoft · internet explorerJul 14, 2008

  • CVE-2008-2595
    23Monitor

    Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknow

    MediumCVSS 5.0Proof of conceptEPSS 11%

    oracle · database 10gJul 15, 2008

  • CVE-2008-3242
    45Plan

    Heap-based buffer overflow in the PPMedia Class ActiveX control in PPMPlayer.dll in PPMate 2.3.1.93 allows remote attackers to execute arbit

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    ppmate · ppmedia classJul 21, 2008

  • CVE-2008-3257
    65This week

    Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allow

    CriticalCVSS 10.0WeaponizedEPSS 83%

    bea · weblogic serverJul 22, 2008

  • CVE-2008-3263
    39Monitor

    The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.

    HighCVSS 7.8Proof of conceptEPSS 28%

    asterisk · asteriskJul 22, 2008

  • CVE-2008-3269
    23Monitor

    WRPCServer.exe in WinSoftMagic WinRemotePC (WRPC) Lite 2008 and Full 2008 allows remote attackers to cause a denial of service (CPU consumpt

    MediumCVSS 5.0Proof of conceptEPSS 10%

    winsoftmagic · winremotepc fullJul 24, 2008

  • CVE-2008-3362
    45Plan

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attacke

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    giulio ganci · wp downloads managerJul 30, 2008

  • CVE-2008-3364
    47Plan

    Buffer overflow in the ObjRemoveCtrl Class ActiveX control in OfficeScanRemoveCtrl.dll 7.3.0.1020 in Trend Micro OfficeScan Corp Edition (OS

    CriticalCVSS 9.3Proof of conceptEPSS 32%

    trend micro · officescanJul 30, 2008

  • CVE-2008-3409
    33Monitor

    Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daem

    HighCVSS 7.5Proof of conceptEPSS 11%

    epic games · unreal tournament 3Jul 31, 2008