Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: март 2008 г.

51 записей · 0 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2008-1116
    40В плане

    Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner allows remote attackers

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    rising antivirus international · rising web scan object3 мар. 2008 г.

  • CVE-2008-1124
    33Наблюдать

    Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary P

    СредняяCVSS 6,8Proof of conceptEPSS 21 %

    podcast generator · podcast generator3 мар. 2008 г.

  • CVE-2008-1126
    34Наблюдать

    PHP remote file inclusion vulnerability in main.php in Barryvan Compo Manager 0.3 allows remote attackers to execute arbitrary PHP code via

    СредняяCVSS 6,8Proof of conceptEPSS 23 %

    barryvan compo · barryvan compo manager3 мар. 2008 г.

  • CVE-2008-1145
    28Наблюдать

    Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems

    СредняяCVSS 5,0Proof of conceptEPSS 27 %

    ruby-lang · webrick4 мар. 2008 г.

  • CVE-2008-1188
    41В плане

    Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and

    КритическаяCVSS 9,3Эксплойта нетEPSS 12 %

    sun · jdk6 мар. 2008 г.

  • CVE-2008-1190
    42В плане

    Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and e

    КритическаяCVSS 9,3Эксплойта нетEPSS 16 %

    sun · jdk6 мар. 2008 г.

  • CVE-2008-1193
    41В плане

    Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and

    КритическаяCVSS 9,3Proof of conceptEPSS 12 %

    sun · jdk6 мар. 2008 г.

  • CVE-2008-1200
    41В плане

    Unspecified vulnerability in Microsoft Access allows remote user-assisted attackers to execute arbitrary code via a crafted .MDB file, possi

    КритическаяCVSS 9,3Эксплойта нетEPSS 11 %

    microsoft · access6 мар. 2008 г.

  • CVE-2008-1270
    24Наблюдать

    mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to rea

    СредняяCVSS 5,0Proof of conceptEPSS 11 %

    lighttpd · lighttpd10 мар. 2008 г.

  • CVE-2007-1201
    46В плане

    Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute ar

    КритическаяCVSS 9,3Эксплойта нетEPSS 28 %

    microsoft · biztalk server11 мар. 2008 г.

  • CVE-2008-0110
    47В плане

    Unspecified vulnerability in Microsoft Outlook in Office 2000 SP3, XP SP3, 2003 SP2 and Sp3, and Office System allows user-assisted remote a

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · office11 мар. 2008 г.

  • CVE-2008-0111
    52В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-ass

    КритическаяCVSS 9,3Proof of conceptEPSS 50 %

    microsoft · excel11 мар. 2008 г.

  • CVE-2008-0112
    47В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3, and Office for Mac 2004 and 2008 allows user-assisted remote attackers to execute arb

    КритическаяCVSS 9,3Proof of conceptEPSS 32 %

    microsoft · excel11 мар. 2008 г.

  • CVE-2008-0113
    50В плане

    Unspecified vulnerability in Microsoft Office Excel Viewer 2003 up to SP3 allows user-assisted remote attackers to execute arbitrary code vi

    КритическаяCVSS 9,3Proof of conceptEPSS 42 %

    microsoft · excel viewer11 мар. 2008 г.

  • CVE-2008-0114
    49В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office for Mac 2004 allows user-assisted remote att

    КритическаяCVSS 9,3Proof of conceptEPSS 38 %

    microsoft · excel11 мар. 2008 г.

  • CVE-2008-0115
    49В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-ass

    КритическаяCVSS 9,3Proof of conceptEPSS 39 %

    microsoft · excel11 мар. 2008 г.

  • CVE-2008-0116
    51В плане

    Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote att

    КритическаяCVSS 9,3Proof of conceptEPSS 48 %

    microsoft · excel11 мар. 2008 г.

  • CVE-2008-0117
    47В плане

    Unspecified vulnerability in Microsoft Excel 2000 SP3 and 2002 SP2, and Office 2004 and 2008 for Mac, allows user-assisted remote attackers

    КритическаяCVSS 9,3Proof of conceptEPSS 33 %

    microsoft · compatibility pack word excel powerpoint 200711 мар. 2008 г.

  • CVE-2008-0118
    47В плане

    Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-a

    КритическаяCVSS 9,3Proof of conceptEPSS 34 %

    microsoft · office11 мар. 2008 г.

  • CVE-2008-1203
    35Наблюдать

    The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for

    ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %

    adobe · coldfusion11 мар. 2008 г.

  • CVE-2008-1307
    44В плане

    Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Online Update Module 200

    КритическаяCVSS 10,0Proof of conceptEPSS 14 %

    kingsoft · antivirus online update module12 мар. 2008 г.

  • CVE-2008-1309
    51В плане

    The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before

    КритическаяCVSS 9,3Готовый эксплойтEPSS 45 %

    realnetworks · realplayer12 мар. 2008 г.

  • CVE-2008-1311
    40В плане

    The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang)

    СредняяCVSS 5,0Готовый эксплойтEPSS 49 %

    packettrap · pt360 tool suite pro12 мар. 2008 г.

  • CVE-2008-1320
    45В плане

    Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial

    КритическаяCVSS 10,0Proof of conceptEPSS 16 %

    asg · asg-sentry13 мар. 2008 г.

  • CVE-2008-0532
    57В плане

    Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server

    КритическаяCVSS 10,0Proof of conceptEPSS 57 %

    cisco · acs for windows14 мар. 2008 г.

  • CVE-2008-0533
    26Наблюдать

    Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Sec

    СредняяCVSS 4,3Proof of conceptEPSS 28 %

    cisco · acs for windows14 мар. 2008 г.

  • CVE-2008-1117
    61На этой неделе

    Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows

    КритическаяCVSS 10,0Готовый эксплойтEPSS 69 %

    netopia · timbuktu pro14 мар. 2008 г.

  • CVE-2008-1157
    46В плане

    Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen

    КритическаяCVSS 10,0Эксплойта нетEPSS 20 %

    cisco · ciscoworks internetwork performance monitor14 мар. 2008 г.

  • CVE-2008-1358
    43В плане

    Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary co

    СредняяCVSS 6,5Готовый эксплойтEPSS 57 %

    altn · mdaemon17 мар. 2008 г.

  • CVE-2008-1365
    40В плане

    Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and e

    СредняяCVSS 6,4Готовый эксплойтEPSS 51 %

    trend micro · officescan corporate edition17 мар. 2008 г.

  • CVE-2008-1368
    20Наблюдать

    CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp://

    СредняяCVSS 4,3Эксплойта нетEPSS 11 %

    microsoft · internet explorer17 мар. 2008 г.

  • CVE-2008-0062
    42В плане

    KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    mit · kerberos 519 мар. 2008 г.

  • CVE-2008-1405
    38Наблюдать

    PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code vi

    СредняяCVSS 6,8Proof of conceptEPSS 37 %

    fuzzylime · fuzzylime20 мар. 2008 г.

  • CVE-2008-1416
    38Наблюдать

    Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in

    СредняяCVSS 6,8Proof of conceptEPSS 37 %

    phpauction · phpauction gpl20 мар. 2008 г.

  • CVE-2008-1201
    33Наблюдать

    Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows

    СредняяCVSS 6,8Эксплойта нетEPSS 19 %

    adobe · flash24 мар. 2008 г.

  • CVE-2008-1289
    33Наблюдать

    Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Editi

    ВысокаяCVSS 7,5Proof of conceptEPSS 11 %

    asterisk · asterisk appliance developer kit24 мар. 2008 г.

  • CVE-2008-1461
    33Наблюдать

    Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command

    ВысокаяCVSS 7,6Proof of conceptEPSS 11 %

    xnview · xnview24 мар. 2008 г.

  • CVE-2008-0951
    46В плане

    Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and po

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · windows vista24 мар. 2008 г.

  • CVE-2008-1472
    49В плане

    Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Ba

    КритическаяCVSS 9,3Готовый эксплойтEPSS 40 %

    computer associates · brightstor arcserve backup laptops desktops24 мар. 2008 г.

  • CVE-2008-1160
    43В плане

    ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows re

    КритическаяCVSS 9,8Proof of conceptEPSS 14 %

    zyxel · zywall 1050 firmware24 мар. 2008 г.

  • CVE-2008-1489
    31Наблюдать

    Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) an

    СредняяCVSS 6,8Proof of conceptEPSS 11 %

    videolan · vlc24 мар. 2008 г.

  • CVE-2008-1092
    45В плане

    Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a cr

    КритическаяCVSS 9,3Эксплойта нетEPSS 25 %

    microsoft · windows 200025 мар. 2008 г.

  • CVE-2008-1491
    61На этой неделе

    Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows re

    КритическаяCVSS 10,0Готовый эксплойтEPSS 70 %

    asus · remote console25 мар. 2008 г.

  • CVE-2008-1502
    20Наблюдать

    The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and o

    СредняяCVSS 4,3Эксплойта нетEPSS 10 %

    egroupware · egroupware25 мар. 2008 г.

  • CVE-2008-1505
    44В плане

    PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote a

    ВысокаяCVSS 7,5Proof of conceptEPSS 46 %

    joomla · joomla25 мар. 2008 г.

  • CVE-2008-1391
    36Наблюдать

    Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-depen

    ВысокаяCVSS 7,5Proof of conceptEPSS 18 %

    freebsd · freebsd27 мар. 2008 г.

  • CVE-2008-0926
    47В плане

    The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authenticatio

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 58 %

    novell · edirectory28 мар. 2008 г.

  • CVE-2008-1544
    36Наблюдать

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request

    ВысокаяCVSS 7,1Эксплойта нетEPSS 26 %

    microsoft · internet explorer28 мар. 2008 г.

  • CVE-2008-1545
    21Наблюдать

    The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding

    СредняяCVSS 4,3Эксплойта нетEPSS 11 %

    microsoft · internet explorer28 мар. 2008 г.

  • CVE-2008-1558
    45В плане

    Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite

    КритическаяCVSS 10,0Proof of conceptEPSS 16 %

    mplayer · mplayer31 мар. 2008 г.

  • CVE-2008-1562
    40В плане

    The LDAP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service (application

    СредняяCVSS 5,0Готовый эксплойтEPSS 50 %

    wireshark · wireshark31 мар. 2008 г.