Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: январь 2008 г.

56 записей · 0 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2007-6613
    24Наблюдать

    Stack-based buffer overflow in the print_iso9660_recurse function in iso-info (src/iso-info.c) in GNU Compact Disc Input and Control Library

    СредняяCVSS 5,0Proof of conceptEPSS 12 %

    gnu · libcdio3 янв. 2008 г.

  • CVE-2007-6638
    44В плане

    March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to o

    КритическаяCVSS 10,0Proof of conceptEPSS 12 %

    march networks · 3204 dvr3 янв. 2008 г.

  • CVE-2008-0090
    27Наблюдать

    A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 cra

    СредняяCVSS 5,0Proof of conceptEPSS 22 %

    divx · divx player3 янв. 2008 г.

  • CVE-2008-0095
    28Наблюдать

    The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance

    СредняяCVSS 5,0Proof of conceptEPSS 25 %

    asterisk · asterisk appliance developer kit7 янв. 2008 г.

  • CVE-2007-6388
    40В плане

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 throu

    СредняяCVSS 4,3Эксплойта нетEPSS 75 %

    apache · http server8 янв. 2008 г.

  • CVE-2008-0139
    34Наблюдать

    Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP co

    СредняяCVSS 6,8Proof of conceptEPSS 22 %

    loudblog · loudblog8 янв. 2008 г.

  • CVE-2008-0144
    43В плане

    PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via

    ВысокаяCVSS 7,5Proof of conceptEPSS 44 %

    phprisk · netrisk8 янв. 2008 г.

  • CVE-2007-0066
    37Наблюдать

    The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attac

    ВысокаяCVSS 7,1Эксплойта нетEPSS 31 %

    microsoft · home server8 янв. 2008 г.

  • CVE-2007-0069
    52В плане

    Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of ser

    КритическаяCVSS 9,3Эксплойта нетEPSS 49 %

    microsoft · windows 2003 server8 янв. 2008 г.

  • CVE-2007-5360
    35Наблюдать

    Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWa

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    openpegasus · management server8 янв. 2008 г.

  • CVE-2008-0153
    24Наблюдать

    telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) vi

    СредняяCVSS 5,0Proof of conceptEPSS 13 %

    pragma systems · pragma telnetserver8 янв. 2008 г.

  • CVE-2007-6250
    45В плане

    Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might

    КритическаяCVSS 9,3Эксплойта нетEPSS 25 %

    aol · aolmediaplaybackcontrol9 янв. 2008 г.

  • CVE-2008-0220
    35Наблюдать

    Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gatewa

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    gateway · cweblaunchctl activex control10 янв. 2008 г.

  • CVE-2008-0225
    29Наблюдать

    Heap-based buffer overflow in the rmff_dump_cont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to e

    СредняяCVSS 6,4Proof of conceptEPSS 14 %

    xine · xine-lib10 янв. 2008 г.

  • CVE-2008-0226
    57В плане

    Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitr

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 91 %

    yassl · yassl10 янв. 2008 г.

  • CVE-2008-0234
    41В плане

    Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers

    КритическаяCVSS 9,3Proof of conceptEPSS 12 %

    apple · quicktime10 янв. 2008 г.

  • CVE-2008-0235
    49В плане

    The Microsoft VFP_OLE_Server ActiveX control allows remote attackers to execute arbitrary code by invoking the foxcommand method.

    КритическаяCVSS 10,0Эксплойта нетEPSS 29 %

    microsoft · vfp ole server activex control10 янв. 2008 г.

  • CVE-2008-0236
    28Наблюдать

    An ActiveX control for Microsoft Visual FoxPro (vfp6r.dll 6.0.8862.0) allows remote attackers to execute arbitrary commands by invoking the

    СредняяCVSS 5,8Proof of conceptEPSS 17 %

    microsoft · visual foxpro10 янв. 2008 г.

  • CVE-2008-0237
    33Наблюдать

    The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary commands by invoking the in

    СредняяCVSS 6,8Proof of conceptEPSS 20 %

    microsoft · rich textbox control10 янв. 2008 г.

  • CVE-2008-0005
    21Наблюдать

    mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows

    СредняяCVSS 4,3Эксплойта нетEPSS 14 %

    apache · http server11 янв. 2008 г.

  • CVE-2008-0244
    64На этой неделе

    SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec

    КритическаяCVSS 10,0Готовый эксплойтEPSS 80 %

    sap · maxdb11 янв. 2008 г.

  • CVE-2008-0248
    40В плане

    Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary c

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    streamaudio · chaincast proxymanager activex control11 янв. 2008 г.

  • CVE-2008-0250
    42В плане

    Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN)

    КритическаяCVSS 9,3Proof of conceptEPSS 16 %

    microsoft · visual interdev11 янв. 2008 г.

  • CVE-2008-0122
    44В плане

    Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEAS

    КритическаяCVSS 10,0Эксплойта нетEPSS 12 %

    isc · bind15 янв. 2008 г.

  • CVE-2008-0295
    37Наблюдать

    Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlie

    ВысокаяCVSS 8,5Proof of conceptEPSS 11 %

    videolan · vlc media player16 янв. 2008 г.

  • CVE-2008-0296
    44В плане

    Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RT

    КритическаяCVSS 10,0Proof of conceptEPSS 14 %

    videolan · vlc media player16 янв. 2008 г.

  • CVE-2008-0081
    56В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote att

    КритическаяCVSS 9,8Proof of conceptEPSS 57 %

    microsoft · excel16 янв. 2008 г.

  • CVE-2007-6681
    35Наблюдать

    Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long

    ВысокаяCVSS 7,5Proof of conceptEPSS 17 %

    videolan · vlc16 янв. 2008 г.

  • CVE-2007-6682
    35Наблюдать

    Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote attackers to execute a

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    videolan · vlc16 янв. 2008 г.

  • CVE-2008-0027
    57В плане

    Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (C

    КритическаяCVSS 10,0Эксплойта нетEPSS 57 %

    cisco · unified callmanager16 янв. 2008 г.

  • CVE-2008-0333
    23Наблюдать

    Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET allows remote attackers

    СредняяCVSS 5,0Proof of conceptEPSS 11 %

    afterlogic · mailbee webmail pro17 янв. 2008 г.

  • CVE-2008-0339
    44В плане

    Unspecified vulnerability in the XML DB component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 has unknown impact and remot

    КритическаяCVSS 10,0Proof of conceptEPSS 14 %

    oracle · database server17 янв. 2008 г.

  • CVE-2008-0352
    34Наблюдать

    The Linux kernel 2.6.20 through 2.6.21.1 allows remote attackers to cause a denial of service (panic) via a certain IPv6 packet, possibly in

    ВысокаяCVSS 7,8Proof of conceptEPSS 10 %

    linux · linux kernel17 янв. 2008 г.

  • CVE-2008-0356
    62На этой неделе

    Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 a

    КритическаяCVSS 10,0Эксплойта нетEPSS 72 %

    citrix · access essentials18 янв. 2008 г.

  • CVE-2008-0065
    58В плане

    Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a lon

    КритическаяCVSS 10,0Готовый эксплойтEPSS 61 %

    winamp · nullsoft winamp22 янв. 2008 г.

  • CVE-2008-0376
    36Наблюдать

    PHP remote file inclusion vulnerability in inc/linkbar.php in Small Axe Weblog 0.3.1 allows remote attackers to execute arbitrary PHP code v

    СредняяCVSS 6,8Proof of conceptEPSS 31 %

    softpedia · small axe weblog22 янв. 2008 г.

  • CVE-2008-0380
    44В плане

    Buffer overflow in the Digital Data Communications RtspVaPgCtrl ActiveX control (RtspVapgDecoder.dll 1.1.0.29) allows remote attackers to ex

    КритическаяCVSS 10,0Proof of conceptEPSS 12 %

    digital data communications · rtspvapgdecoder.dll22 янв. 2008 г.

  • CVE-2008-0382
    43В плане

    Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter

    ВысокаяCVSS 7,5Proof of conceptEPSS 41 %

    mybulletinboard · mybulletinboard22 янв. 2008 г.

  • CVE-2008-0128
    26Наблюдать

    The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the

    СредняяCVSS 5,0Proof of conceptEPSS 19 %

    apache · tomcat22 янв. 2008 г.

  • CVE-2008-0392
    46В плане

    Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary cod

    КритическаяCVSS 9,3Proof of conceptEPSS 30 %

    microsoft · visual basic22 янв. 2008 г.

  • CVE-2008-0394
    34Наблюдать

    Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    citadel · smtp23 янв. 2008 г.

  • CVE-2008-0423
    38Наблюдать

    Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY

    СредняяCVSS 6,8Proof of conceptEPSS 37 %

    lama · lama software23 янв. 2008 г.

  • CVE-2008-0434
    40В плане

    Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    gecad technologies · axigen mail server23 янв. 2008 г.

  • CVE-2008-0437
    57В плане

    Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installat

    КритическаяCVSS 10,0Proof of conceptEPSS 58 %

    hp · virtual rooms23 янв. 2008 г.

  • CVE-2008-0443
    44В плане

    Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUploader Module allows

    КритическаяCVSS 10,0Proof of conceptEPSS 12 %

    lycos · fileuploader.dll24 янв. 2008 г.

  • CVE-2008-0454
    45В плане

    Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows

    КритическаяCVSS 9,3Эксплойта нетEPSS 25 %

    microsoft · windows24 янв. 2008 г.

  • CVE-2008-0455
    36Наблюдать

    Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.

    СредняяCVSS 4,3Proof of conceptEPSS 64 %

    apache · http server24 янв. 2008 г.

  • CVE-2008-0456
    16Наблюдать

    CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earli

    НизкаяCVSS 2,6Эксплойта нетEPSS 19 %

    apache · http server24 янв. 2008 г.

  • CVE-2008-0460
    21Наблюдать

    Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8

    СредняяCVSS 4,3Эксплойта нетEPSS 14 %

    mediawiki · mediawiki25 янв. 2008 г.

  • CVE-2008-0175
    35Наблюдать

    Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute a

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    ge fanuc · proficy real-time information portal28 янв. 2008 г.

  • CVE-2008-0387
    45В плане

    Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote at

    ВысокаяCVSS 7,8Proof of conceptEPSS 45 %

    firebirdsql · firebird28 янв. 2008 г.

  • CVE-2008-0470
    46В плане

    A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method.

    КритическаяCVSS 9,3Proof of conceptEPSS 30 %

    comodo · comodo antivirus29 янв. 2008 г.

  • CVE-2008-0477
    44В плане

    Stack-based buffer overflow in the QMPUpgrade.Upgrade.1 ActiveX control in QMPUpgrade.dll 1.0.0.1 in Move Networks Upgrade Manager allows re

    КритическаяCVSS 10,0Proof of conceptEPSS 14 %

    move networks inc · move media player29 янв. 2008 г.

  • CVE-2008-0492
    40В плане

    Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote

    СредняяCVSS 6,8Готовый эксплойтEPSS 29 %

    persits · xupload30 янв. 2008 г.

  • CVE-2008-0503
    34Наблюдать

    Eval injection vulnerability in admin/op/disp.php in Netwerk Smart Publisher 1.0.1 allows remote attackers to execute arbitrary PHP code via

    СредняяCVSS 6,8Proof of conceptEPSS 23 %

    netwerk · smart publisher31 янв. 2008 г.

  • CVE-2008-0506
    45В плане

    include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configure

    СредняяCVSS 6,8Готовый эксплойтEPSS 58 %

    coppermine · coppermine photo gallery31 янв. 2008 г.