Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2008

27 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-4910
    43Plan

    The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    sun · java web startNov 3, 2008

  • CVE-2008-2992
    91Now

    Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file t

    HighCVSS 7.8KEVWeaponizedEPSS 98%

    adobe · acrobatNov 4, 2008

  • CVE-2008-4922
    47Plan

    Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu_ActiveX_MSOffice.dll) allows remote attackers to execute arbitrar

    CriticalCVSS 9.3WeaponizedEPSS 32%

    djvu · activex control for microsoft office 2000Nov 4, 2008

  • CVE-2008-4814
    41Plan

    Unspecified vulnerability in a JavaScript method in Adobe Reader and Acrobat 8.1.2 and earlier, and before 7.1.1, allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 11%

    adobe · acrobatNov 5, 2008

  • CVE-2008-5002
    49Plan

    Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Comp

    CriticalCVSS 9.3WeaponizedEPSS 40%

    chilkat software · chilkat crypt activex controlNov 10, 2008

  • CVE-2008-4387
    42Plan

    Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary cod

    CriticalCVSS 9.3No exploitEPSS 15%

    sap · sapguiNov 10, 2008

  • CVE-2008-5032
    40Plan

    Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code v

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    videolan · vlc media playerNov 10, 2008

  • CVE-2008-5036
    49Plan

    Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code vi

    CriticalCVSS 9.3WeaponizedEPSS 41%

    videolan · vlc media playerNov 10, 2008

  • CVE-2008-4029
    25Monitor

    Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensi

    MediumCVSS 4.3Proof of conceptEPSS 26%

    microsoft · internet explorerNov 12, 2008

  • CVE-2008-4033
    25Monitor

    Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, a

    MediumCVSS 4.3Proof of conceptEPSS 27%

    microsoft · xml core servicesNov 12, 2008

  • CVE-2008-4037
    55Plan

    Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB

    CriticalCVSS 9.3WeaponizedEPSS 59%

    microsoft · windowsNov 12, 2008

  • CVE-2008-5053
    59Plan

    PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows rem

    CriticalCVSS 10.0Proof of conceptEPSS 64%

    joomla · com rssreaderNov 13, 2008

  • CVE-2008-5106
    44Plan

    Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute

    CriticalCVSS 10.0WeaponizedEPSS 12%

    karjasoft · sami ftp serverNov 17, 2008

  • CVE-2008-4824
    41Plan

    Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute

    CriticalCVSS 9.3No exploitEPSS 13%

    adobe · flash playerNov 17, 2008

  • CVE-2008-5112
    25Monitor

    The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt

    MediumCVSS 5.0Proof of conceptEPSS 17%

    microsoft · windowsNov 17, 2008

  • CVE-2008-5159
    58Plan

    Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote at

    CriticalCVSS 10.0WeaponizedEPSS 59%

    clientsoftware · wincome mpd totalNov 18, 2008

  • CVE-2008-5161
    60This week

    Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through

    LowCVSS 3.7WeaponizedEPSS 18%

    ssh · tectia clientNov 19, 2008

  • CVE-2008-5177
    45Plan

    Stack-based buffer overflow in the DtbClsLogin function in Yosemite Backup 8.7 allows remote attackers to (1) execute arbitrary code on a Li

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    insight-tech · yosemite backupNov 20, 2008

  • CVE-2008-5178
    46Plan

    Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file:// URI.

    CriticalCVSS 9.3Proof of conceptEPSS 31%

    opera · operaNov 20, 2008

  • CVE-2008-5179
    25Monitor

    Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote att

    MediumCVSS 5.0No exploitEPSS 16%

    microsoft · office communications serverNov 20, 2008

  • CVE-2008-5180
    41Plan

    Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consump

    MediumCVSS 5.3Proof of conceptEPSS 67%

    microsoft · office communicatorNov 20, 2008

  • CVE-2008-5181
    24Monitor

    Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing l

    MediumCVSS 5.0No exploitEPSS 12%

    microsoft · office communicatorNov 20, 2008

  • CVE-2008-5191
    40Plan

    Multiple SQL injection vulnerabilities in SePortal 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) poll_id paramete

    HighCVSS 7.5WeaponizedEPSS 17%

    seportal · seportalNov 21, 2008

  • CVE-2008-5220
    44Plan

    Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary c

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    wportfolio · wportfolioNov 25, 2008

  • CVE-2008-2431
    52Plan

    Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint

    CriticalCVSS 9.3No exploitEPSS 51%

    novell · iprintNov 25, 2008

  • CVE-2008-5232
    47Plan

    Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media

    CriticalCVSS 9.3Proof of conceptEPSS 32%

    microsoft · windows 2000Nov 25, 2008

  • CVE-2008-5282
    45Plan

    Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    w3c · amaya web browserNov 28, 2008