Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: апрель 2008 г.

46 записей · 0 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2008-1609
    40В плане

    Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to execute arbitrary P

    СредняяCVSS 6,8Proof of conceptEPSS 44 %

    jaf cms · jaf cms1 апр. 2008 г.

  • CVE-2008-1610
    46В плане

    Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service or execute arbitrary

    ВысокаяCVSS 7,5Готовый эксплойтEPSS 53 %

    tallsoft quick · tftp server pro1 апр. 2008 г.

  • CVE-2008-1611
    60На этой неделе

    Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or execute arbitrary code

    КритическаяCVSS 10,0Готовый эксплойтEPSS 67 %

    tftp-server · winagents tftp server1 апр. 2008 г.

  • CVE-2008-1682
    35Наблюдать

    PHP remote file inclusion vulnerability in quiz/common/db_config.inc.php in the Online FlashQuiz (com_onlineflashquiz) 1.0.2 component for J

    СредняяCVSS 6,8Proof of conceptEPSS 26 %

    elearningforce · online flashquiz4 апр. 2008 г.

  • CVE-2008-0311
    46В плане

    Stack-based buffer overflow in the PGMWebHandler::parse_request function in the StarTeam Multicast Service component (STMulticastService) 6.

    КритическаяCVSS 9,3Готовый эксплойтEPSS 31 %

    borland · caliberrm6 апр. 2008 г.

  • CVE-2008-1602
    60На этой неделе

    Stack-based buffer overflow in Orbit downloader 2.6.3 and 2.6.4 allows remote attackers to execute arbitrary code via a long download URL, w

    КритическаяCVSS 10,0Готовый эксплойтEPSS 67 %

    orbit downloader · orbit downloader6 апр. 2008 г.

  • CVE-2007-4620
    52В плане

    Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0

    КритическаяCVSS 9,0Готовый эксплойтEPSS 52 %

    ca · brightstor arcserve backup7 апр. 2008 г.

  • CVE-2008-1328
    44В плане

    Buffer overflow in the LGServer service in CA ARCserve Backup for Laptops and Desktops r11.0 through r11.5, and Suite 11.1 and 11.2, allows

    КритическаяCVSS 9,3Эксплойта нетEPSS 23 %

    broadcom · desktop management suite7 апр. 2008 г.

  • CVE-2008-1697
    62На этой неделе

    Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to

    КритическаяCVSS 10,0Готовый эксплойтEPSS 74 %

    hp · openview network node manager8 апр. 2008 г.

  • CVE-2008-0083
    46В плане

    The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2,

    КритическаяCVSS 9,3Эксплойта нетEPSS 29 %

    microsoft · windows 20008 апр. 2008 г.

  • CVE-2008-0087
    40В плане

    The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows

    ВысокаяCVSS 7,5Эксплойта нетEPSS 32 %

    microsoft · windows 20008 апр. 2008 г.

  • CVE-2008-1083
    49В плане

    Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vi

    ВысокаяCVSS 8,1Proof of conceptEPSS 56 %

    microsoft · windows 20008 апр. 2008 г.

  • CVE-2008-1085
    47В плане

    Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 through SP1, and 7 allows remote attackers to execute arbitrary code

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · ie8 апр. 2008 г.

  • CVE-2008-1086
    46В плане

    The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · windows 20008 апр. 2008 г.

  • CVE-2008-1087
    54В плане

    Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote atta

    КритическаяCVSS 9,3Proof of conceptEPSS 56 %

    microsoft · windows-nt8 апр. 2008 г.

  • CVE-2008-1088
    47В плане

    Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a craft

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · project8 апр. 2008 г.

  • CVE-2008-1089
    47В плане

    Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · office8 апр. 2008 г.

  • CVE-2008-1090
    47В плане

    Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · office8 апр. 2008 г.

  • CVE-2008-1709
    41В плане

    Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN)

    КритическаяCVSS 9,3Proof of conceptEPSS 13 %

    microsoft · visual interdev9 апр. 2008 г.

  • CVE-2007-0071
    65На этой неделе

    Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code vi

    КритическаяCVSS 9,3Эксплойта нетEPSS 92 %

    adobe · flash player9 апр. 2008 г.

  • CVE-2007-6019
    55В плане

    Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a

    КритическаяCVSS 9,3Proof of conceptEPSS 59 %

    adobe · air9 апр. 2008 г.

  • CVE-2008-1721
    37Наблюдать

    Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a ne

    ВысокаяCVSS 7,5Proof of conceptEPSS 22 %

    python · python10 апр. 2008 г.

  • CVE-2008-1724
    48В плане

    Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1

    КритическаяCVSS 9,3Готовый эксплойтEPSS 35 %

    tumbleweed · securetransport server11 апр. 2008 г.

  • CVE-2008-0927
    41В плане

    dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTT

    СредняяCVSS 5,0Proof of conceptEPSS 70 %

    novell · edirectory14 апр. 2008 г.

  • CVE-2008-1100
    43В плане

    Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbit

    КритическаяCVSS 10,0Эксплойта нетEPSS 10 %

    clam anti-virus · clamav14 апр. 2008 г.

  • CVE-2008-1773
    35Наблюдать

    PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via

    СредняяCVSS 6,8Proof of conceptEPSS 26 %

    dragoon · dragoon14 апр. 2008 г.

  • CVE-2008-1776
    35Наблюдать

    PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute ar

    СредняяCVSS 6,8Proof of conceptEPSS 26 %

    phpblock · phpblock14 апр. 2008 г.

  • CVE-2008-1842
    44В плане

    Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to c

    КритическаяCVSS 10,0Proof of conceptEPSS 12 %

    hp · openview network node manager16 апр. 2008 г.

  • CVE-2008-0892
    40В плане

    The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and E

    КритическаяCVSS 9,0Эксплойта нетEPSS 14 %

    redhat · directory server16 апр. 2008 г.

  • CVE-2008-0320
    54В плане

    Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and

    КритическаяCVSS 9,3Готовый эксплойтEPSS 56 %

    openoffice · openoffice.org17 апр. 2008 г.

  • CVE-2008-1876
    35Наблюдать

    PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in t

    СредняяCVSS 6,8Proof of conceptEPSS 27 %

    snarky · visualpic17 апр. 2008 г.

  • CVE-2008-1878
    35Наблюдать

    Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote at

    ВысокаяCVSS 7,5Proof of conceptEPSS 15 %

    xine · xine-lib17 апр. 2008 г.

  • CVE-2008-1881
    31Наблюдать

    Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary c

    СредняяCVSS 6,8Proof of conceptEPSS 11 %

    videolan · vlc17 апр. 2008 г.

  • CVE-2008-1436
    47В плане

    Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2)

    КритическаяCVSS 9,0Proof of conceptEPSS 36 %

    microsoft · windows-nt21 апр. 2008 г.

  • CVE-2008-1898
    53В плане

    A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote

    КритическаяCVSS 9,3Готовый эксплойтEPSS 52 %

    microsoft · office21 апр. 2008 г.

  • CVE-2008-1903
    42В плане

    PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote a

    ВысокаяCVSS 7,5Proof of conceptEPSS 39 %

    newanz · newsoffice22 апр. 2008 г.

  • CVE-2008-1912
    41В плане

    Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause a denial of service

    КритическаяCVSS 9,3Proof of conceptEPSS 11 %

    divx · divx player22 апр. 2008 г.

  • CVE-2008-1914
    62На этой неделе

    Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to e

    КритическаяCVSS 10,0Готовый эксплойтEPSS 73 %

    bigantsoft · bigant messenger22 апр. 2008 г.

  • CVE-2007-6255
    46В плане

    Buffer overflow in the Microsoft HeartbeatCtl ActiveX control in HRTBEAT.OCX allows remote attackers to execute arbitrary code via the Host

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · windows 200023 апр. 2008 г.

  • CVE-2008-1765
    43В плане

    Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remote attackers and phys

    КритическаяCVSS 9,3Proof of conceptEPSS 19 %

    adobe · photoshop23 апр. 2008 г.

  • CVE-2008-1933
    21Наблюдать

    Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary file

    СредняяCVSS 4,3Proof of conceptEPSS 13 %

    microsoft · zune software25 апр. 2008 г.

  • CVE-2008-1963
    42В плане

    PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbi

    ВысокаяCVSS 7,5Proof of conceptEPSS 39 %

    quate · grape web statistics25 апр. 2008 г.

  • CVE-2008-1965
    40В плане

    Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used b

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    ibm · lotus expeditor client25 апр. 2008 г.

  • CVE-2008-1996
    23Наблюдать

    licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number

    СредняяCVSS 5,0Proof of conceptEPSS 11 %

    licq · licq28 апр. 2008 г.

  • CVE-2008-2031
    40В плане

    VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereferen

    СредняяCVSS 5,0Готовый эксплойтEPSS 46 %

    vicftps · vicftps30 апр. 2008 г.

  • CVE-2008-2040
    34Наблюдать

    Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote

    ВысокаяCVSS 7,5Proof of conceptEPSS 14 %

    peercast · peercast30 апр. 2008 г.