Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2008

34 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-3878
    48Plan

    Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Contro

    CriticalCVSS 9.3WeaponizedEPSS 36%

    ultrashareware · ultra office controlSep 2, 2008

  • CVE-2008-3892
    47Plan

    Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x

    CriticalCVSS 10.0Proof of conceptEPSS 24%

    vmware · aceSep 3, 2008

  • CVE-2008-3922
    53Plan

    awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort paramet

    CriticalCVSS 9.3WeaponizedEPSS 53%

    telartis bv · awstats totalsSep 4, 2008

  • CVE-2007-5348
    53Plan

    Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2

    CriticalCVSS 9.3Proof of conceptEPSS 52%

    microsoft · digital image suiteSep 10, 2008

  • CVE-2008-2253
    46Plan

    Unspecified vulnerability in Microsoft Windows Media Player 11 allows remote attackers to execute arbitrary code via a crafted audio-only fi

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · windows media playerSep 10, 2008

  • CVE-2008-3007
    47Plan

    Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeSep 10, 2008

  • CVE-2008-3008
    53Plan

    Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9 Series allows remote

    CriticalCVSS 9.3WeaponizedEPSS 54%

    microsoft · windows media encoderSep 10, 2008

  • CVE-2008-3012
    46Plan

    gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008,

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · digital image suiteSep 10, 2008

  • CVE-2008-3013
    53Plan

    gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008,

    CriticalCVSS 9.3Proof of conceptEPSS 52%

    microsoft · digital image suiteSep 10, 2008

  • CVE-2008-3014
    48Plan

    Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and

    CriticalCVSS 9.3No exploitEPSS 36%

    microsoft · digital image suiteSep 10, 2008

  • CVE-2008-3015
    49Plan

    Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visi

    CriticalCVSS 9.3No exploitEPSS 39%

    microsoft · digital image suiteSep 10, 2008

  • CVE-2008-3956
    41Plan

    orgchart.exe in Microsoft Organization Chart 2.00 allows user-assisted attackers to cause a denial of service (application crash) or possibl

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    microsoft · organization chartSep 10, 2008

  • CVE-2008-3957
    42Plan

    The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a clien

    CriticalCVSS 9.3Proof of conceptEPSS 17%

    microsoft · windows image acquisition loggerSep 10, 2008

  • CVE-2008-3529
    47Plan

    Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to

    CriticalCVSS 10.0Proof of conceptEPSS 23%

    xmlsoft · libxml2Sep 12, 2008

  • CVE-2008-4071
    26Monitor

    A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows remote attackers to cau

    MediumCVSS 5.0Proof of conceptEPSS 18%

    adobe · acrobatSep 15, 2008

  • CVE-2008-4110
    36Monitor

    Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\Binn\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0)

    HighCVSS 7.6No exploitEPSS 18%

    microsoft · sql serverSep 16, 2008

  • CVE-2008-4114
    43Plan

    srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 al

    HighCVSS 7.1WeaponizedEPSS 49%

    microsoft · windows 2000Sep 16, 2008

  • CVE-2008-4096
    37Monitor

    libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request

    HighCVSS 8.5Proof of conceptEPSS 11%

    phpmyadmin · phpmyadminSep 18, 2008

  • CVE-2008-4109
    29Monitor

    A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE use

    MediumCVSS 5.0Proof of conceptEPSS 28%

    debian · linuxSep 18, 2008

  • CVE-2008-4116
    40Plan

    Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser crash) or possibly exe

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    apple · itunesSep 18, 2008

  • CVE-2008-4127
    22Monitor

    Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · internet explorerSep 18, 2008

  • CVE-2008-4128
    72This week

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv

    HighCVSS 8.1KEVWeaponizedEPSS 33%

    cisco · iosSep 18, 2008

  • CVE-2008-4138
    43Plan

    PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows remote attackers to e

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    technote · technoteSep 24, 2008

  • CVE-2008-4193
    62This week

    Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary

    CriticalCVSS 10.0WeaponizedEPSS 74%

    alt-n · securitygatewaySep 24, 2008

  • CVE-2008-0016
    53Plan

    Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote a

    CriticalCVSS 10.0Proof of conceptEPSS 43%

    mozilla · firefoxSep 24, 2008

  • CVE-2008-4295
    30Monitor

    Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth co

    MediumCVSS 5.4Proof of conceptEPSS 30%

    microsoft · windows mobileSep 27, 2008

  • CVE-2008-4299
    25Monitor

    A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · internet authentication service helper com componentSep 29, 2008

  • CVE-2008-4300
    24Monitor

    A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of servic

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · internet information servicesSep 29, 2008

  • CVE-2008-4301
    45Plan

    A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a str

    CriticalCVSS 10.0No exploitEPSS 17%

    microsoft · internet information servicesSep 29, 2008

  • CVE-2008-4318
    44Plan

    Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) wh

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    project-observer · observerSep 29, 2008

  • CVE-2008-3827
    40Plan

    Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of se

    CriticalCVSS 9.3No exploitEPSS 10%

    mplayer · mplayerSep 29, 2008

  • CVE-2008-4322
    60This week

    Stack-based buffer overflow in RealFlex Technologies Ltd.

    CriticalCVSS 10.0WeaponizedEPSS 65%

    realflex technologies ltd · realwin serverSep 29, 2008

  • CVE-2008-4327
    22Monitor

    gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial

    MediumCVSS 4.3Proof of conceptEPSS 15%

    microsoft · windows xpSep 30, 2008

  • CVE-2008-4342
    42Plan

    NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.

    CriticalCVSS 9.3Proof of conceptEPSS 17%

    numedia soft · numedia dvd burning sdkSep 30, 2008