Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2008

66 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-5297
    36Monitor

    Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update r

    HighCVSS 7.6Proof of conceptEPSS 18%

    vitalwerks · no-ip ducDec 1, 2008

  • CVE-2008-5353
    66This week

    The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2

    CriticalCVSS 10.0WeaponizedEPSS 85%

    sun · jdkDec 5, 2008

  • CVE-2008-5357
    40Plan

    Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK a

    CriticalCVSS 9.3No exploitEPSS 10%

    sun · jreDec 5, 2008

  • CVE-2008-5359
    40Plan

    Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK an

    CriticalCVSS 9.3No exploitEPSS 10%

    sun · jreDec 5, 2008

  • CVE-2008-4310
    35Monitor

    httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of s

    HighCVSS 7.8Proof of conceptEPSS 13%

    ruby-lang · rubyDec 8, 2008

  • CVE-2008-5405
    51Plan

    Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attac

    CriticalCVSS 9.3WeaponizedEPSS 46%

    oxid · cain and abelDec 10, 2008

  • CVE-2008-5409
    40Plan

    Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Securit

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    bitdefender · antivirusDec 10, 2008

  • CVE-2008-2249
    46Plan

    Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows r

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · windows 2000Dec 10, 2008

  • CVE-2008-3009
    45Plan

    Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly

    CriticalCVSS 10.0No exploitEPSS 15%

    microsoft · windows media playerDec 10, 2008

  • CVE-2008-3010
    45Plan

    Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate

    CriticalCVSS 10.0No exploitEPSS 15%

    microsoft · windows media playerDec 10, 2008

  • CVE-2008-3465
    43Plan

    Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and

    CriticalCVSS 9.8No exploitEPSS 13%

    microsoft · windows 2000Dec 10, 2008

  • CVE-2008-4024
    46Plan

    Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document wit

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · officeDec 10, 2008

  • CVE-2008-4025
    47Plan

    Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 G

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeDec 10, 2008

  • CVE-2008-4026
    44Plan

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeDec 10, 2008

  • CVE-2008-4027
    47Plan

    Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word View

    CriticalCVSS 9.3No exploitEPSS 33%

    microsoft · officeDec 10, 2008

  • CVE-2008-4028
    48Plan

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office

    CriticalCVSS 9.3No exploitEPSS 38%

    microsoft · officeDec 10, 2008

  • CVE-2008-4030
    44Plan

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Off

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeDec 10, 2008

  • CVE-2008-4031
    44Plan

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeDec 10, 2008

  • CVE-2008-4032
    44Plan

    Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorizati

    HighCVSS 7.5No exploitEPSS 47%

    microsoft · office sharepoint serverDec 10, 2008

  • CVE-2008-4252
    40Plan

    The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors dur

    HighCVSS 8.5No exploitEPSS 20%

    microsoft · office frontpageDec 10, 2008

  • CVE-2008-4253
    40Plan

    The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office

    HighCVSS 8.5No exploitEPSS 20%

    microsoft · office frontpageDec 10, 2008

  • CVE-2008-4254
    41Plan

    Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 S

    HighCVSS 8.5No exploitEPSS 22%

    microsoft · office frontpageDec 10, 2008

  • CVE-2008-4255
    53Plan

    Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual B

    CriticalCVSS 9.3Proof of conceptEPSS 53%

    microsoft · office frontpageDec 10, 2008

  • CVE-2008-4256
    40Plan

    The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 an

    HighCVSS 8.5No exploitEPSS 20%

    microsoft · office frontpageDec 10, 2008

  • CVE-2008-4258
    39Monitor

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote

    HighCVSS 8.5No exploitEPSS 17%

    microsoft · internet explorerDec 10, 2008

  • CVE-2008-4259
    47Plan

    Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrar

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · internet explorerDec 10, 2008

  • CVE-2008-4260
    40Plan

    Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a c

    HighCVSS 8.5No exploitEPSS 19%

    microsoft · internet explorerDec 10, 2008

  • CVE-2008-4261
    46Plan

    Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not pro

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerDec 10, 2008

  • CVE-2008-4264
    45Plan

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibili

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · office excelDec 10, 2008

  • CVE-2008-4265
    44Plan

    Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · office excelDec 10, 2008

  • CVE-2008-4266
    45Plan

    Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 f

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · excelDec 10, 2008

  • CVE-2008-4268
    40Plan

    The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation f

    HighCVSS 8.5No exploitEPSS 20%

    microsoft · windows server 2008Dec 10, 2008

  • CVE-2008-4269
    40Plan

    The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obt

    HighCVSS 8.5No exploitEPSS 20%

    microsoft · windows server 2008Dec 10, 2008

  • CVE-2008-4837
    48Plan

    Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Off

    CriticalCVSS 9.3No exploitEPSS 37%

    microsoft · officeDec 10, 2008

  • CVE-2008-4841
    50Plan

    The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to e

    CriticalCVSS 9.3Proof of conceptEPSS 43%

    microsoft · wordpadDec 10, 2008

  • CVE-2008-5416
    62This week

    Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) S

    CriticalCVSS 9.0WeaponizedEPSS 87%

    microsoft · sql serverDec 10, 2008

  • CVE-2008-4844
    57Plan

    Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6

    CriticalCVSS 9.3WeaponizedEPSS 66%

    microsoft · internet explorerDec 11, 2008

  • CVE-2008-5424
    21Monitor

    The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · outlook expressDec 11, 2008

  • CVE-2008-5492
    48Plan

    Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX Control allows remo

    CriticalCVSS 9.3WeaponizedEPSS 35%

    verypdf · verydoc pdf viewerDec 12, 2008

  • CVE-2008-5539
    40Plan

    RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of

    CriticalCVSS 9.3No exploitEPSS 10%

    rising-global · rising antivirusDec 12, 2008

  • CVE-2008-5551
    21Monitor

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS atta

    MediumCVSS 4.3Proof of conceptEPSS 13%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5552
    20Monitor

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS atta

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5553
    20Monitor

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which all

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5554
    21Monitor

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a U

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5555
    21Monitor

    Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which all

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5556
    20Monitor

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are e

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · internet explorerDec 12, 2008

  • CVE-2008-5587
    21Monitor

    Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote

    MediumCVSS 4.3Proof of conceptEPSS 12%

    phppgadmin · phppgadminDec 16, 2008

  • CVE-2008-5081
    40Plan

    The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attacker

    MediumCVSS 5.0WeaponizedEPSS 59%

    avahi · avahiDec 16, 2008

  • CVE-2008-5619
    58Plan

    html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2

    CriticalCVSS 10.0Proof of conceptEPSS 58%

    roundcube · webmailDec 16, 2008

  • CVE-2008-5626
    40Plan

    XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command,

    MediumCVSS 4.0WeaponizedEPSS 35%

    dxmsoft · xm easy personal ftp serverDec 17, 2008

  • CVE-2008-5499
    61This week

    Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrar

    CriticalCVSS 9.3WeaponizedEPSS 79%

    adobe · flash player for linuxDec 17, 2008

  • CVE-2008-5664
    48Plan

    Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to

    CriticalCVSS 9.3WeaponizedEPSS 36%

    realtek · realtek media playerDec 18, 2008

  • CVE-2008-5666
    40Plan

    WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence

    LowCVSS 3.5WeaponizedEPSS 20%

    wftpserver · winftp ftp serverDec 18, 2008

  • CVE-2008-5692
    24Monitor

    Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read

    MediumCVSS 5.0Proof of conceptEPSS 12%

    ipswitch · ws ftpDec 19, 2008

  • CVE-2008-5695
    38Monitor

    wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option,

    HighCVSS 8.5Proof of conceptEPSS 12%

    wordpress · wordpressDec 19, 2008

  • CVE-2008-5711
    47Plan

    Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3WeaponizedEPSS 32%

    facebook · photouploaderDec 24, 2008

  • CVE-2008-5722
    44Plan

    Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execut

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    sawstudio · sawstudioDec 26, 2008

  • CVE-2008-5732
    34Monitor

    Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute arbitrary code by upl

    HighCVSS 7.5Proof of conceptEPSS 13%

    kafooeyblog · kafooeyblogDec 26, 2008

  • CVE-2008-5745
    23Monitor

    Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, including 11.0.5721.5260,

    MediumCVSS 4.3Proof of conceptEPSS 21%

    microsoft · windows media playerDec 29, 2008

  • CVE-2008-5748
    35Monitor

    Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files vi

    HighCVSS 8.1Proof of conceptEPSS 10%

    bloofox · bloofoxcmsDec 29, 2008

  • CVE-2008-5750
    33Monitor

    Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary comm

    MediumCVSS 6.8Proof of conceptEPSS 21%

    microsoft · internet explorerDec 29, 2008

  • CVE-2008-5763
    42Plan

    PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to e

    HighCVSS 7.5Proof of conceptEPSS 39%

    mariovaldez · simple text-file login scriptDec 30, 2008

  • CVE-2008-5764
    51Plan

    PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows remote attackers to ex

    CriticalCVSS 9.3Proof of conceptEPSS 45%

    2500mhz · worksimpleDec 30, 2008

  • CVE-2008-5789
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow re

    HighCVSS 7.5Proof of conceptEPSS 44%

    recly · interactive feederatorDec 31, 2008

  • CVE-2008-5790
    41Plan

    Multiple PHP remote file inclusion vulnerabilities in the Recly!Competitions (com_competitions) component 1.0 for Joomla! allow remote attac

    HighCVSS 7.5Proof of conceptEPSS 36%

    recly · competitionsDec 31, 2008

  • CVE-2008-5793
    34Monitor

    Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for Joomla! allow remote

    MediumCVSS 6.8Proof of conceptEPSS 24%

    joomla · joomlaDec 31, 2008