Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: апрель 2007 г.

53 записей · 0 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2007-1819
    49В плане

    Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Cente

    КритическаяCVSS 9,3Готовый эксплойтEPSS 39 %

    hp · mercury quality center2 апр. 2007 г.

  • CVE-2007-1825
    33Наблюдать

    Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrar

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    php · php2 апр. 2007 г.

  • CVE-2007-1211
    37Наблюдать

    Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attac

    ВысокаяCVSS 7,1Proof of conceptEPSS 29 %

    microsoft · windows 20004 апр. 2007 г.

  • CVE-2007-1866
    43В плане

    Stack-based buffer overflow in the dns_decode_reverse_name function in dns_decode.c in dproxy-nexgen allows remote attackers to execute arbi

    КритическаяCVSS 10,0Proof of conceptEPSS 10 %

    dproxy · dproxy4 апр. 2007 г.

  • CVE-2007-1868
    58В плане

    The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-da

    КритическаяCVSS 10,0Готовый эксплойтEPSS 59 %

    ibm · tivoli provisioning manager os deployment4 апр. 2007 г.

  • CVE-2007-0956
    49В плане

    The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username

    КритическаяCVSS 10,0Эксплойта нетEPSS 29 %

    mit · kerberos 55 апр. 2007 г.

  • CVE-2007-0957
    39Наблюдать

    Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) a

    КритическаяCVSS 9,0Эксплойта нетEPSS 10 %

    mit · kerberos 55 апр. 2007 г.

  • CVE-2007-1687
    43В плане

    Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attack

    КритическаяCVSS 10,0Proof of conceptEPSS 11 %

    internet pictures corporation · ipix image well10 апр. 2007 г.

  • CVE-2007-0938
    54В плане

    Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request,

    КритическаяCVSS 10,0Эксплойта нетEPSS 45 %

    microsoft · content management server10 апр. 2007 г.

  • CVE-2007-0939
    22Наблюдать

    Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inje

    СредняяCVSS 4,3Эксплойта нетEPSS 16 %

    microsoft · content management server10 апр. 2007 г.

  • CVE-2007-1205
    46В плане

    Unspecified vulnerability in Microsoft Agent (msagent\agentsvr.exe) in Windows 2000 SP4, XP SP2, and Server 2003, 2003 SP1, and 2003 SP2 all

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · windows 200010 апр. 2007 г.

  • CVE-2006-7192
    24Наблюдать

    Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass reque

    СредняяCVSS 4,3Эксплойта нетEPSS 22 %

    microsoft · .net framework10 апр. 2007 г.

  • CVE-2007-1910
    34Наблюдать

    Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly ex

    СредняяCVSS 6,8Proof of conceptEPSS 24 %

    microsoft · word10 апр. 2007 г.

  • CVE-2007-1911
    32Наблюдать

    Multiple unspecified vulnerabilities in Microsoft Word 2007 allow remote attackers to cause a denial of service (CPU consumption) via crafte

    ВысокаяCVSS 7,1Proof of conceptEPSS 11 %

    microsoft · word10 апр. 2007 г.

  • CVE-2007-1912
    30Наблюдать

    Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a crafted .HLP file.

    СредняяCVSS 6,8Proof of conceptEPSS 11 %

    microsoft · windows 200010 апр. 2007 г.

  • CVE-2007-1357
    35Наблюдать

    The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial

    ВысокаяCVSS 7,8Proof of conceptEPSS 13 %

    linux · linux kernel10 апр. 2007 г.

  • CVE-2007-1946
    48В плане

    Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service (cr

    КритическаяCVSS 10,0Эксплойта нетEPSS 26 %

    microsoft · windows xp10 апр. 2007 г.

  • CVE-2007-1559
    47В плане

    Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via

    КритическаяCVSS 9,3Готовый эксплойтEPSS 31 %

    roxio · cineplayer11 апр. 2007 г.

  • CVE-2007-1748
    63На этой неделе

    Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Serve

    КритическаяCVSS 10,0Готовый эксплойтEPSS 77 %

    microsoft · windows 200013 апр. 2007 г.

  • CVE-2007-2031
    45В плане

    Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before 20070413, might allow remote attackers to execute

    КритическаяCVSS 10,0Proof of conceptEPSS 15 %

    3proxy · 3proxy16 апр. 2007 г.

  • CVE-2007-2052
    24Наблюдать

    Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be us

    СредняяCVSS 5,0Proof of conceptEPSS 13 %

    python · python16 апр. 2007 г.

  • CVE-2007-1674
    62На этой неделе

    Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary

    КритическаяCVSS 10,0Готовый эксплойтEPSS 72 %

    landesk · landesk management suite17 апр. 2007 г.

  • CVE-2007-2057
    46В плане

    Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authenticati

    КритическаяCVSS 10,0Proof of conceptEPSS 19 %

    aircrack-ng · airodump-ng17 апр. 2007 г.

  • CVE-2007-2093
    44В плане

    Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) 1.0 allows remote attackers to inject ar

    ВысокаяCVSS 7,5Proof of conceptEPSS 45 %

    limesoft · limesoft guestbook18 апр. 2007 г.

  • CVE-2007-2108
    33Наблюдать

    Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote a

    СредняяCVSS 6,8Эксплойта нетEPSS 21 %

    oracle · database server18 апр. 2007 г.

  • CVE-2007-2141
    44В плане

    Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shout

    ВысокаяCVSS 7,5Proof of conceptEPSS 45 %

    shoutpro · shoutpro19 апр. 2007 г.

  • CVE-2007-2156
    33Наблюдать

    Multiple PHP remote file inclusion vulnerabilities in Rezervi Generic 0.9 allow remote attackers to execute arbitrary PHP code via a URL in

    ВысокаяCVSS 7,5Proof of conceptEPSS 10 %

    rezervi generic · rezervi generic19 апр. 2007 г.

  • CVE-2007-2161
    21Наблюдать

    Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expr

    СредняяCVSS 4,3Эксплойта нетEPSS 12 %

    microsoft · internet explorer22 апр. 2007 г.

  • CVE-2007-2165
    24Наблюдать

    The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module

    СредняяCVSS 5,1Эксплойта нетEPSS 12 %

    proftpd project · proftpd22 апр. 2007 г.

  • CVE-2007-2167
    43В плане

    Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number

    ВысокаяCVSS 7,5Proof of conceptEPSS 44 %

    aimstats · aimstats22 апр. 2007 г.

  • CVE-2007-2175
    55В плане

    Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to exe

    ВысокаяCVSS 7,6Готовый эксплойтEPSS 83 %

    apple · safari24 апр. 2007 г.

  • CVE-2007-0746
    43В плане

    Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbit

    КритическаяCVSS 10,0Эксплойта нетEPSS 10 %

    apple · mac os x24 апр. 2007 г.

  • CVE-2007-2193
    48В плане

    Stack-based buffer overflow in the ID_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-ass

    КритическаяCVSS 9,3Готовый эксплойтEPSS 36 %

    acd systems · acdsee24 апр. 2007 г.

  • CVE-2007-2194
    46В плане

    Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a l

    КритическаяCVSS 10,0Proof of conceptEPSS 18 %

    gentoo · xnview24 апр. 2007 г.

  • CVE-2007-2171
    47В плане

    Stack-based buffer overflow in the base64_decode function in GWINTER.exe in Novell GroupWise (GW) WebAccess before 7.0 SP2 allows remote att

    КритическаяCVSS 10,0Эксплойта нетEPSS 24 %

    novell · groupwise24 апр. 2007 г.

  • CVE-2007-2199
    41В плане

    PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConc

    СредняяCVSS 6,8Proof of conceptEPSS 46 %

    cjg explorer pro · cjg explorer pro24 апр. 2007 г.

  • CVE-2007-2200
    43В плане

    Directory traversal vulnerability in navigator/navigator_ok.php in Pagode 0.5.8 allows remote attackers to read and possibly delete arbitrar

    КритическаяCVSS 10,0Proof of conceptEPSS 10 %

    pagode · pagode24 апр. 2007 г.

  • CVE-2007-2209
    30Наблюдать

    Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.20 and possibly othe

    СредняяCVSS 6,8Proof of conceptEPSS 11 %

    accusoft · imagegear24 апр. 2007 г.

  • CVE-2007-2244
    47В плане

    Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attackers to execute arbi

    КритическаяCVSS 9,3Proof of conceptEPSS 31 %

    adobe · golive25 апр. 2007 г.

  • CVE-2007-2139
    63На этой неделе

    Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used

    КритическаяCVSS 10,0Готовый эксплойтEPSS 77 %

    ca · brightstor arcserve backup25 апр. 2007 г.

  • CVE-2007-2285
    35Наблюдать

    Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 (Ext JS) allows remote attackers to read a

    ВысокаяCVSS 7,8Proof of conceptEPSS 11 %

    jack slocum · ext js26 апр. 2007 г.

  • CVE-2007-1683
    38Наблюдать

    Stack-based buffer overflow in the DoWebMenuAction function in the IncrediMail IMMenuShellExt ActiveX control (ImShExt.dll) allows remote at

    СредняяCVSS 6,8Proof of conceptEPSS 37 %

    incredimail · immenushellext activex control26 апр. 2007 г.

  • CVE-2007-2291
    36Наблюдать

    CRLF injection vulnerability in the Digest Authentication support for Microsoft Internet Explorer 7.0.5730.11 allows remote attackers to con

    ВысокаяCVSS 7,5Эксплойта нетEPSS 20 %

    microsoft · internet explorer26 апр. 2007 г.

  • CVE-2007-2292
    21Наблюдать

    CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remot

    СредняяCVSS 4,3Эксплойта нетEPSS 12 %

    mozilla · firefox26 апр. 2007 г.

  • CVE-2007-2293
    37Наблюдать

    Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3

    ВысокаяCVSS 7,6Proof of conceptEPSS 23 %

    asterisk · asterisk26 апр. 2007 г.

  • CVE-2007-2340
    40В плане

    Multiple PHP remote file inclusion vulnerabilities in inc/include_all.inc.php in phporacleview allow remote attackers to execute arbitrary P

    СредняяCVSS 6,8Proof of conceptEPSS 42 %

    phporacleview · phporacleview27 апр. 2007 г.

  • CVE-2007-2353
    28Наблюдать

    Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installati

    СредняяCVSS 5,0Proof of conceptEPSS 27 %

    apache · axis30 апр. 2007 г.

  • CVE-2007-2356
    32Наблюдать

    Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote atta

    СредняяCVSS 6,8Proof of conceptEPSS 15 %

    gimp · gimp30 апр. 2007 г.

  • CVE-2007-2362
    41В плане

    Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitra

    КритическаяCVSS 9,0Proof of conceptEPSS 16 %

    don moore · mydns30 апр. 2007 г.

  • CVE-2007-2365
    49В плане

    Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers

    КритическаяCVSS 9,3Proof of conceptEPSS 41 %

    adobe · golive30 апр. 2007 г.

  • CVE-2007-2366
    39Наблюдать

    Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.

    ВысокаяCVSS 7,4Proof of conceptEPSS 33 %

    corel · paint shop pro30 апр. 2007 г.

  • CVE-2007-2374
    42В плане

    Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via

    КритическаяCVSS 9,3Эксплойта нетEPSS 17 %

    microsoft · windows 200030 апр. 2007 г.

  • CVE-2007-2380
    24Наблюдать

    The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows r

    СредняяCVSS 5,0Эксплойта нетEPSS 12 %

    microsoft · atlas framework30 апр. 2007 г.