Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2008

64 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-4381
    26Monitor

    Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert f

    MediumCVSS 5.0No exploitEPSS 18%

    microsoft · internet explorerOct 2, 2008

  • CVE-2008-2439
    40Plan

    Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Mi

    MediumCVSS 5.0WeaponizedEPSS 20%

    trend micro · officescanOct 3, 2008

  • CVE-2008-4434
    40Plan

    Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attac

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    utorrent · utorrentOct 3, 2008

  • CVE-2008-4449
    49Plan

    Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.

    CriticalCVSS 9.3WeaponizedEPSS 38%

    mirc · mircOct 6, 2008

  • CVE-2008-4453
    40Plan

    The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 Gd

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    dspicture · light imaging toolkitOct 6, 2008

  • CVE-2008-4384
    46Plan

    Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow re

    CriticalCVSS 9.3WeaponizedEPSS 28%

    iseemedia · lpviewerOct 7, 2008

  • CVE-2008-4493
    32Monitor

    Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote att

    MediumCVSS 6.8Proof of conceptEPSS 17%

    microsoft · digital imageOct 8, 2008

  • CVE-2008-4500
    19Monitor

    Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafte

    MediumCVSS 4.0Proof of conceptEPSS 10%

    solarwinds · serv-u file serverOct 8, 2008

  • CVE-2008-4501
    39Monitor

    Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to o

    CriticalCVSS 9.0Proof of conceptEPSS 10%

    solarwinds · serv-u file serverOct 8, 2008

  • CVE-2008-3641
    47Plan

    The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen w

    CriticalCVSS 10.0Proof of conceptEPSS 24%

    apple · cupsOct 10, 2008

  • CVE-2008-3544
    41Plan

    Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, al

    CriticalCVSS 9.0Proof of conceptEPSS 18%

    hp · openview network node managerOct 13, 2008

  • CVE-2008-4546
    37Monitor

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denia

    MediumCVSS 4.3Proof of conceptEPSS 65%

    adobe · flash playerOct 14, 2008

  • CVE-2008-4547
    40Plan

    Heap-based buffer overflow in the PdvrAtl.PdvrOcx.1 ActiveX control (pdvratl.dll) in DVRHOST Web CMS OCX 1.0.1.25 allows remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    dvrstation · dvrstation cmsOct 14, 2008

  • CVE-2008-4385
    48Plan

    Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of

    CriticalCVSS 9.3WeaponizedEPSS 37%

    systemrequirementslab · system requirements labOct 14, 2008

  • CVE-2008-4397
    64This week

    Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 throu

    CriticalCVSS 10.0WeaponizedEPSS 80%

    ca · arcserve backupOct 14, 2008

  • CVE-2008-3982
    40Plan

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    MediumCVSS 5.5WeaponizedEPSS 11%

    oracle · database 10gOct 14, 2008

  • CVE-2008-3983
    40Plan

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    MediumCVSS 5.5WeaponizedEPSS 41%

    oracle · database 10gOct 14, 2008

  • CVE-2008-3984
    40Plan

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    MediumCVSS 5.5WeaponizedEPSS 41%

    oracle · database 10gOct 14, 2008

  • CVE-2008-3995
    40Plan

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticat

    MediumCVSS 5.5WeaponizedEPSS 9%

    oracle · database 10gOct 14, 2008

  • CVE-2008-3996
    40Plan

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticat

    MediumCVSS 5.5WeaponizedEPSS 9%

    oracle · database 10gOct 14, 2008

  • CVE-2008-4008
    57Plan

    Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP

    CriticalCVSS 10.0WeaponizedEPSS 56%

    oracle · bea product suiteOct 14, 2008

  • CVE-2008-4479
    43Plan

    Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to ex

    CriticalCVSS 10.0No exploitEPSS 10%

    novell · edirectoryOct 14, 2008

  • CVE-2008-4480
    43Plan

    Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to ex

    CriticalCVSS 10.0No exploitEPSS 10%

    novell · edirectoryOct 14, 2008

  • CVE-2008-4556
    61This week

    Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers

    CriticalCVSS 10.0WeaponizedEPSS 69%

    sun · solarisOct 14, 2008

  • CVE-2008-4557
    54Plan

    plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code v

    CriticalCVSS 10.0Proof of conceptEPSS 45%

    cutephp · cutenewsOct 14, 2008

  • CVE-2008-1446
    50Plan

    Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on

    CriticalCVSS 9.0No exploitEPSS 46%

    microsoft · internet information servicesOct 14, 2008

  • CVE-2008-3466
    63This week

    Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote atta

    CriticalCVSS 10.0WeaponizedEPSS 77%

    microsoft · host integration server 2000Oct 14, 2008

  • CVE-2008-3471
    53Plan

    Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Of

    CriticalCVSS 9.3No exploitEPSS 52%

    microsoft · excelOct 14, 2008

  • CVE-2008-3472
    47Plan

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3473
    47Plan

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3474
    34Monitor

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    MediumCVSS 6.5No exploitEPSS 27%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3475
    47Plan

    Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (

    HighCVSS 8.8No exploitEPSS 39%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3476
    46Plan

    Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remo

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3477
    48Plan

    Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Off

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · internet explorerOct 14, 2008

  • CVE-2008-3479
    53Plan

    Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers

    CriticalCVSS 10.0No exploitEPSS 44%

    microsoft · windows 2000Oct 14, 2008

  • CVE-2008-4019
    47Plan

    Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 20

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · excelOct 14, 2008

  • CVE-2008-4020
    24Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a doc

    MediumCVSS 4.3No exploitEPSS 24%

    microsoft · officeOct 14, 2008

  • CVE-2008-4023
    52Plan

    Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote at

    CriticalCVSS 10.0No exploitEPSS 39%

    microsoft · windows 2000Oct 14, 2008

  • CVE-2008-4038
    52Plan

    Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote a

    CriticalCVSS 10.0No exploitEPSS 39%

    microsoft · windows 2000Oct 14, 2008

  • CVE-2008-4572
    58Plan

    GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary

    CriticalCVSS 10.0WeaponizedEPSS 60%

    guildftpd · guildftpdOct 15, 2008

  • CVE-2008-4582
    20Monitor

    Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly

    MediumCVSS 4.3Proof of conceptEPSS 10%

    mozilla · firefoxOct 15, 2008

  • CVE-2008-4587
    40Plan

    Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovisio

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    acresso · flexnet connectOct 15, 2008

  • CVE-2008-4609
    38Monitor

    The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operatin

    HighCVSS 7.1Proof of conceptEPSS 32%

    bsd · bsdOct 20, 2008

  • CVE-2008-4619
    44Plan

    The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    sun · sunosOct 20, 2008

  • CVE-2008-1547
    31Monitor

    Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638)

    MediumCVSS 4.3Proof of conceptEPSS 48%

    microsoft · exchange serverOct 20, 2008

  • CVE-2008-4652
    40Plan

    Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to exec

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    dart · powertcp ftp for activexOct 21, 2008

  • CVE-2008-4654
    54Plan

    Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4

    CriticalCVSS 9.3WeaponizedEPSS 57%

    videolan · vlc media playerOct 21, 2008

  • CVE-2008-4668
    42Plan

    Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and

    CriticalCVSS 9.0Proof of conceptEPSS 21%

    joomla · com imagebrowserOct 22, 2008

  • CVE-2008-4687
    56Plan

    manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP

    CriticalCVSS 9.0WeaponizedEPSS 67%

    mantis · mantisOct 22, 2008

  • CVE-2008-4688
    24Monitor

    core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source

    MediumCVSS 5.0No exploitEPSS 11%

    mantis · mantisOct 22, 2008

  • CVE-2008-4699
    45Plan

    Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrar

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    microsoft · peachtree accountingOct 22, 2008

  • CVE-2008-2469
    47Plan

    Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to exec

    CriticalCVSS 10.0Proof of conceptEPSS 22%

    libspf · libspf2Oct 23, 2008

  • CVE-2008-3862
    46Plan

    Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and

    CriticalCVSS 10.0No exploitEPSS 18%

    trend micro · officescanOct 23, 2008

  • CVE-2008-4250
    99Now

    The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    microsoft · windows 2000Oct 23, 2008

  • CVE-2008-4696
    40Plan

    Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML vi

    MediumCVSS 4.3WeaponizedEPSS 45%

    opera · operaOct 23, 2008

  • CVE-2008-4726
    49Plan

    Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long

    CriticalCVSS 9.0Proof of conceptEPSS 44%

    goodtechsystems · goodtech sshOct 23, 2008

  • CVE-2008-4728
    46Plan

    Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deploym

    CriticalCVSS 9.3Proof of conceptEPSS 31%

    hummingbird · deployment wizardOct 23, 2008

  • CVE-2008-4762
    40Plan

    Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially

    CriticalCVSS 9.0Proof of conceptEPSS 14%

    freesshd · freesshdOct 27, 2008

  • CVE-2008-4764
    25Monitor

    Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read a

    MediumCVSS 5.0Proof of conceptEPSS 16%

    extplorer · com extplorerOct 27, 2008

  • CVE-2008-4779
    59Plan

    Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long file

    CriticalCVSS 10.0WeaponizedEPSS 64%

    tguzip · tguzipOct 29, 2008

  • CVE-2008-4787
    27Monitor

    Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname

    MediumCVSS 5.8Proof of conceptEPSS 13%

    microsoft · internet explorerOct 29, 2008

  • CVE-2008-4800
    28Monitor

    The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denia

    MediumCVSS 5.0Proof of conceptEPSS 25%

    microsoft · debug diagnostic toolOct 30, 2008

  • CVE-2008-4801
    43Plan

    Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler

    CriticalCVSS 10.0No exploitEPSS 11%

    ibm · tivoli storage manager clientOct 30, 2008

  • CVE-2008-4864
    36Monitor

    Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out o

    HighCVSS 7.5Proof of conceptEPSS 21%

    python · pythonOct 31, 2008