Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: август 2008 г.

56 записей · 1 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2007-2952
    42В плане

    Multiple stack-based buffer overflows in the filter service (aka k9filter.exe) in Blue Coat K9 Web Protection 3.2.44 with Filter 3.2.32 allo

    КритическаяCVSS 9,3Эксплойта нетEPSS 15 %

    blue coat systems · filter1 авг. 2008 г.

  • CVE-2008-2935
    34Наблюдать

    Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4Dec

    ВысокаяCVSS 7,5Proof of conceptEPSS 12 %

    xmlsoft · libxslt1 авг. 2008 г.

  • CVE-2008-3175
    44В плане

    Integer underflow in rxRPC.dll in the LGServer service in the server in CA ARCserve Backup for Laptops and Desktops 11.0 through 11.5 allows

    КритическаяCVSS 10,0Эксплойта нетEPSS 14 %

    ca · arcserve backup for laptops and desktops1 авг. 2008 г.

  • CVE-2008-1232
    40В плане

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote

    СредняяCVSS 4,3Proof of conceptEPSS 75 %

    apache · tomcat3 авг. 2008 г.

  • CVE-2008-2321
    41В плане

    Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a

    КритическаяCVSS 9,3Proof of conceptEPSS 12 %

    apple · mac os x3 авг. 2008 г.

  • CVE-2008-2370
    36Наблюдать

    Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normaliz

    СредняяCVSS 5,0Proof of conceptEPSS 52 %

    apache · tomcat3 авг. 2008 г.

  • CVE-2008-3431
    67На этой неделе

    The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTL

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 6 %

    oracle · virtualbox5 авг. 2008 г.

  • CVE-2008-2939
    29Наблюдать

    Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the

    СредняяCVSS 4,3Эксплойта нетEPSS 38 %

    apache · http server6 авг. 2008 г.

  • CVE-2008-0964
    41В плане

    Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, all

    КритическаяCVSS 9,3Proof of conceptEPSS 13 %

    sun · opensolaris8 авг. 2008 г.

  • CVE-2008-3558
    57В плане

    Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before 20.2008.2606.4919 al

    КритическаяCVSS 9,3Готовый эксплойтEPSS 65 %

    cisco · webex meeting manager8 авг. 2008 г.

  • CVE-2008-3273
    40В плане

    JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtai

    СредняяCVSS 5,0Готовый эксплойтEPSS 47 %

    jboss · enterprise application platform10 авг. 2008 г.

  • CVE-2008-3571
    42В плане

    The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900.

    ВысокаяCVSS 7,8Proof of conceptEPSS 35 %

    xerox · phaser10 авг. 2008 г.

  • CVE-2008-3004
    47В плане

    Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3; Office Excel Viewer 2003; and Office 2004 and 2008 for Mac do not properly

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3005
    47В плане

    Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execu

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3006
    48В плане

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel View

    КритическаяCVSS 9,3Эксплойта нетEPSS 35 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3018
    46В плане

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file, which a

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · windows nt12 авг. 2008 г.

  • CVE-2008-3019
    46В плане

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of an Encapsulated Post

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3020
    46В плане

    Microsoft Office 2000 SP3 and XP SP3; Office Converter Pack; and Works 8 do not properly parse the length of a BMP file, which allows remote

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3021
    48В плане

    Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 do not properly parse the length of a PICT file, which a

    КритическаяCVSS 9,3Эксплойта нетEPSS 35 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3460
    47В плане

    WPGIMP32.FLT in Microsoft Office 2000 SP3, XP SP3, and 2003 SP2; Office Converter Pack; and Works 8 does not properly parse the length of a

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · office12 авг. 2008 г.

  • CVE-2008-3648
    44В плане

    nslookup.exe in Microsoft Windows XP SP2 allows user-assisted remote attackers to execute arbitrary code, as demonstrated by an attempted DN

    КритическаяCVSS 9,3Эксплойта нетEPSS 21 %

    microsoft · windows xp12 авг. 2008 г.

  • CVE-2008-0082
    50В плане

    An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attacker

    КритическаяCVSS 10,0Эксплойта нетEPSS 34 %

    microsoft · windows messenger12 авг. 2008 г.

  • CVE-2008-0120
    47В плане

    Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malforme

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · office powerpoint viewer12 авг. 2008 г.

  • CVE-2008-0121
    46В плане

    A "memory calculation error" in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file wit

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · office powerpoint viewer12 авг. 2008 г.

  • CVE-2008-1448
    36Наблюдать

    The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the corr

    ВысокаяCVSS 7,1Эксплойта нетEPSS 26 %

    microsoft · outlook express12 авг. 2008 г.

  • CVE-2008-1455
    35Наблюдать

    A "memory calculation error" in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP2, and 2007 through SP1; Office Compatibility Pack fo

    СредняяCVSS 6,8Эксплойта нетEPSS 25 %

    microsoft · compatibility pack word excel powerpoint12 авг. 2008 г.

  • CVE-2008-2245
    51В плане

    Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS)

    КритическаяCVSS 9,3Proof of conceptEPSS 46 %

    microsoft · windows 200012 авг. 2008 г.

  • CVE-2008-2246
    41В плане

    Microsoft Windows Vista through SP1 and Server 2008 do not properly import the default IPsec policy from a Windows Server 2003 domain to a W

    ВысокаяCVSS 7,8Эксплойта нетEPSS 32 %

    microsoft · windows-nt12 авг. 2008 г.

  • CVE-2008-2938
    47В плане

    Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking a

    СредняяCVSS 4,3Готовый эксплойтEPSS 99 %

    apache · tomcat12 авг. 2008 г.

  • CVE-2008-3655
    34Наблюдать

    Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to criti

    ВысокаяCVSS 7,5Proof of conceptEPSS 14 %

    ruby-lang · ruby12 авг. 2008 г.

  • CVE-2008-3656
    52В плане

    Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick i

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 70 %

    ruby-lang · ruby12 авг. 2008 г.

  • CVE-2008-3657
    34Наблюдать

    The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness

    ВысокаяCVSS 7,5Proof of conceptEPSS 13 %

    ruby-lang · ruby12 авг. 2008 г.

  • CVE-2008-1456
    44В плане

    Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, an

    КритическаяCVSS 9,0Эксплойта нетEPSS 28 %

    microsoft · windows-nt13 авг. 2008 г.

  • CVE-2008-1457
    47В плане

    The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not proper

    КритическаяCVSS 9,0Эксплойта нетEPSS 36 %

    microsoft · windows-nt13 авг. 2008 г.

  • CVE-2008-2254
    46В плане

    Microsoft Internet Explorer 6 and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash) and ex

    КритическаяCVSS 9,3Эксплойта нетEPSS 29 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-2255
    46В плане

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash)

    КритическаяCVSS 9,3Эксплойта нетEPSS 29 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-2256
    46В плане

    Microsoft Internet Explorer 5.01, 6, and 7 does not properly handle objects that have been incorrectly initialized or deleted, which allows

    КритическаяCVSS 9,3Эксплойта нетEPSS 29 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-2257
    48В плане

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den

    КритическаяCVSS 9,3Эксплойта нетEPSS 35 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-2258
    48В плане

    Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den

    КритическаяCVSS 9,3Эксплойта нетEPSS 35 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-2259
    46В плане

    Microsoft Internet Explorer 6 and 7 does not perform proper "argument validation" during print preview, which allows remote attackers to exe

    КритическаяCVSS 9,3Эксплойта нетEPSS 30 %

    microsoft · internet explorer13 авг. 2008 г.

  • CVE-2008-3443
    25Наблюдать

    The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423

    СредняяCVSS 5,0Proof of conceptEPSS 15 %

    ruby-lang · ruby14 авг. 2008 г.

  • CVE-2008-3533
    46В плане

    Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attac

    КритическаяCVSS 10,0Proof of conceptEPSS 19 %

    gnome · yelp18 авг. 2008 г.

  • CVE-2008-3703
    44В плане

    The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (

    КритическаяCVSS 10,0Эксплойта нетEPSS 12 %

    symantec · veritas storage foundation18 авг. 2008 г.

  • CVE-2008-3704
    54В плане

    Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Mic

    КритическаяCVSS 9,3Готовый эксплойтEPSS 55 %

    microsoft · visual basic18 авг. 2008 г.

  • CVE-2008-3732
    41В плане

    Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause a denial of service

    КритическаяCVSS 9,3Proof of conceptEPSS 13 %

    videolan · vlc media player20 авг. 2008 г.

  • CVE-2008-3734
    41В плане

    Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denia

    КритическаяCVSS 9,3Proof of conceptEPSS 13 %

    ipswitch · ws ftp home20 авг. 2008 г.

  • CVE-2008-3794
    30Наблюдать

    Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers

    СредняяCVSS 6,8Proof of conceptEPSS 11 %

    videolan · vlc media player26 авг. 2008 г.

  • CVE-2008-3795
    45В плане

    Buffer overflow in Ipswitch WS_FTP Home client allows remote FTP servers to have an unknown impact via a long "message response."

    КритическаяCVSS 10,0Proof of conceptEPSS 15 %

    ipswitch · ws ftp home27 авг. 2008 г.

  • CVE-2007-1682
    46В плане

    Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote att

    КритическаяCVSS 9,3Готовый эксплойтEPSS 29 %

    softartisans · xfile27 авг. 2008 г.

  • CVE-2008-2433
    42В плане

    The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.

    КритическаяCVSS 9,8Эксплойта нетEPSS 10 %

    trendmicro · client server messaging suite27 авг. 2008 г.

  • CVE-2008-3790
    25Наблюдать

    The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of

    СредняяCVSS 5,0Proof of conceptEPSS 15 %

    ruby-lang · ruby27 авг. 2008 г.

  • CVE-2008-3842
    23Наблюдать

    Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly de

    СредняяCVSS 4,3Эксплойта нетEPSS 20 %

    microsoft · windows-nt27 авг. 2008 г.

  • CVE-2008-3843
    24Наблюдать

    Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detec

    СредняяCVSS 4,3Эксплойта нетEPSS 21 %

    microsoft · windows-nt27 авг. 2008 г.

  • CVE-2008-3480
    40В плане

    Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows re

    КритическаяCVSS 9,3Proof of conceptEPSS 11 %

    anzio · print wizard29 авг. 2008 г.

  • CVE-2008-3873
    22Наблюдать

    The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard

    СредняяCVSS 4,3Эксплойта нетEPSS 16 %

    adobe · flash player29 авг. 2008 г.

  • CVE-2008-3282
    34Наблюдать

    Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1,

    ВысокаяCVSS 7,8Эксплойта нетEPSS 10 %

    apache · openoffice29 авг. 2008 г.