Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2008

56 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-2952
    42Plan

    Multiple stack-based buffer overflows in the filter service (aka k9filter.exe) in Blue Coat K9 Web Protection 3.2.44 with Filter 3.2.32 allo

    CriticalCVSS 9.3No exploitEPSS 15%

    blue coat systems · filterAug 1, 2008

  • CVE-2008-2935
    34Monitor

    Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4Dec

    HighCVSS 7.5Proof of conceptEPSS 12%

    xmlsoft · libxsltAug 1, 2008

  • CVE-2008-3175
    44Plan

    Integer underflow in rxRPC.dll in the LGServer service in the server in CA ARCserve Backup for Laptops and Desktops 11.0 through 11.5 allows

    CriticalCVSS 10.0No exploitEPSS 14%

    ca · arcserve backup for laptops and desktopsAug 1, 2008

  • CVE-2008-1232
    40Plan

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote

    MediumCVSS 4.3Proof of conceptEPSS 75%

    apache · tomcatAug 3, 2008

  • CVE-2008-2321
    41Plan

    Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    apple · mac os xAug 3, 2008

  • CVE-2008-2370
    36Monitor

    Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normaliz

    MediumCVSS 5.0Proof of conceptEPSS 52%

    apache · tomcatAug 3, 2008

  • CVE-2008-3431
    67This week

    The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTL

    HighCVSS 8.8KEVWeaponizedEPSS 6%

    oracle · virtualboxAug 5, 2008

  • CVE-2008-2939
    29Monitor

    Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the

    MediumCVSS 4.3No exploitEPSS 38%

    apache · http serverAug 6, 2008

  • CVE-2008-0964
    41Plan

    Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, all

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    sun · opensolarisAug 8, 2008

  • CVE-2008-3558
    57Plan

    Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before 20.2008.2606.4919 al

    CriticalCVSS 9.3WeaponizedEPSS 65%

    cisco · webex meeting managerAug 8, 2008

  • CVE-2008-3273
    40Plan

    JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtai

    MediumCVSS 5.0WeaponizedEPSS 47%

    jboss · enterprise application platformAug 10, 2008

  • CVE-2008-3571
    42Plan

    The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900.

    HighCVSS 7.8Proof of conceptEPSS 35%

    xerox · phaserAug 10, 2008

  • CVE-2008-3004
    47Plan

    Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3; Office Excel Viewer 2003; and Office 2004 and 2008 for Mac do not properly

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeAug 12, 2008

  • CVE-2008-3005
    47Plan

    Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeAug 12, 2008

  • CVE-2008-3006
    48Plan

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel View

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · officeAug 12, 2008

  • CVE-2008-3018
    46Plan

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file, which a

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows ntAug 12, 2008

  • CVE-2008-3019
    46Plan

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of an Encapsulated Post

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeAug 12, 2008

  • CVE-2008-3020
    46Plan

    Microsoft Office 2000 SP3 and XP SP3; Office Converter Pack; and Works 8 do not properly parse the length of a BMP file, which allows remote

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeAug 12, 2008

  • CVE-2008-3021
    48Plan

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file, which a

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · officeAug 12, 2008

  • CVE-2008-3460
    47Plan

    WPGIMP32.FLT in Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 does not properly parse the length of a

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeAug 12, 2008

  • CVE-2008-3648
    44Plan

    nslookup.exe in Microsoft Windows XP SP2 allows user-assisted remote attackers to execute arbitrary code, as demonstrated by an attempted DN

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · windows xpAug 12, 2008

  • CVE-2008-0082
    50Plan

    An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attacker

    CriticalCVSS 10.0No exploitEPSS 34%

    microsoft · windows messengerAug 12, 2008

  • CVE-2008-0120
    47Plan

    Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malforme

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · office powerpoint viewerAug 12, 2008

  • CVE-2008-0121
    46Plan

    A "memory calculation error" in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file wit

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · office powerpoint viewerAug 12, 2008

  • CVE-2008-1448
    36Monitor

    The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the corr

    HighCVSS 7.1No exploitEPSS 26%

    microsoft · outlook expressAug 12, 2008

  • CVE-2008-1455
    35Monitor

    A "memory calculation error" in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP2, and 2007 through SP1; Office Compatibility Pack fo

    MediumCVSS 6.8No exploitEPSS 25%

    microsoft · compatibility pack word excel powerpointAug 12, 2008

  • CVE-2008-2245
    51Plan

    Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS)

    CriticalCVSS 9.3Proof of conceptEPSS 46%

    microsoft · windows 2000Aug 12, 2008

  • CVE-2008-2246
    41Plan

    Microsoft Windows Vista through SP1 and Server 2008 do not properly import the default IPsec policy from a Windows Server 2003 domain to a W

    HighCVSS 7.8No exploitEPSS 32%

    microsoft · windows-ntAug 12, 2008

  • CVE-2008-2938
    47Plan

    Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking a

    MediumCVSS 4.3WeaponizedEPSS 99%

    apache · tomcatAug 12, 2008

  • CVE-2008-3655
    34Monitor

    Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to criti

    HighCVSS 7.5Proof of conceptEPSS 14%

    ruby-lang · rubyAug 12, 2008

  • CVE-2008-3656
    52Plan

    Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick i

    HighCVSS 7.8WeaponizedEPSS 70%

    ruby-lang · rubyAug 12, 2008

  • CVE-2008-3657
    34Monitor

    The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness

    HighCVSS 7.5Proof of conceptEPSS 13%

    ruby-lang · rubyAug 12, 2008

  • CVE-2008-1456
    44Plan

    Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, an

    CriticalCVSS 9.0No exploitEPSS 28%

    microsoft · windows-ntAug 13, 2008

  • CVE-2008-1457
    47Plan

    The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not proper

    CriticalCVSS 9.0No exploitEPSS 36%

    microsoft · windows-ntAug 13, 2008

  • CVE-2008-2254
    46Plan

    Microsoft Internet Explorer 6 and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash) and ex

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-2255
    46Plan

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash)

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-2256
    46Plan

    Microsoft Internet Explorer 5.01, 6, and 7 does not properly handle objects that have been incorrectly initialized or deleted, which allows

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-2257
    48Plan

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-2258
    48Plan

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-2259
    46Plan

    Microsoft Internet Explorer 6 and 7 does not perform proper "argument validation" during print preview, which allows remote attackers to exe

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · internet explorerAug 13, 2008

  • CVE-2008-3443
    25Monitor

    The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423

    MediumCVSS 5.0Proof of conceptEPSS 15%

    ruby-lang · rubyAug 14, 2008

  • CVE-2008-3533
    46Plan

    Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attac

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    gnome · yelpAug 18, 2008

  • CVE-2008-3703
    44Plan

    The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (

    CriticalCVSS 10.0No exploitEPSS 12%

    symantec · veritas storage foundationAug 18, 2008

  • CVE-2008-3704
    54Plan

    Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Mic

    CriticalCVSS 9.3WeaponizedEPSS 55%

    microsoft · visual basicAug 18, 2008

  • CVE-2008-3732
    41Plan

    Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    videolan · vlc media playerAug 20, 2008

  • CVE-2008-3734
    41Plan

    Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denia

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    ipswitch · ws ftp homeAug 20, 2008

  • CVE-2008-3794
    30Monitor

    Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers

    MediumCVSS 6.8Proof of conceptEPSS 11%

    videolan · vlc media playerAug 26, 2008

  • CVE-2008-3795
    45Plan

    Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message response."

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    ipswitch · ws ftp homeAug 27, 2008

  • CVE-2007-1682
    46Plan

    Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote att

    CriticalCVSS 9.3WeaponizedEPSS 29%

    softartisans · xfileAug 27, 2008

  • CVE-2008-2433
    42Plan

    The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.

    CriticalCVSS 9.8No exploitEPSS 10%

    trendmicro · client server messaging suiteAug 27, 2008

  • CVE-2008-3790
    25Monitor

    The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of

    MediumCVSS 5.0Proof of conceptEPSS 15%

    ruby-lang · rubyAug 27, 2008

  • CVE-2008-3842
    23Monitor

    Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly de

    MediumCVSS 4.3No exploitEPSS 20%

    microsoft · windows-ntAug 27, 2008

  • CVE-2008-3843
    24Monitor

    Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detec

    MediumCVSS 4.3No exploitEPSS 21%

    microsoft · windows-ntAug 27, 2008

  • CVE-2008-3480
    40Plan

    Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows re

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    anzio · print wizardAug 29, 2008

  • CVE-2008-3873
    22Monitor

    The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard

    MediumCVSS 4.3No exploitEPSS 16%

    adobe · flash playerAug 29, 2008

  • CVE-2008-3282
    34Monitor

    Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1,

    HighCVSS 7.8No exploitEPSS 10%

    apache · openofficeAug 29, 2008