Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: октябрь 2008 г.

64 записей · 1 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2008-4381
    26Наблюдать

    Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert f

    СредняяCVSS 5,0Эксплойта нетEPSS 18 %

    microsoft · internet explorer2 окт. 2008 г.

  • CVE-2008-2439
    40В плане

    Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Mi

    СредняяCVSS 5,0Готовый эксплойтEPSS 20 %

    trend micro · officescan3 окт. 2008 г.

  • CVE-2008-4434
    40В плане

    Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attac

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    utorrent · utorrent3 окт. 2008 г.

  • CVE-2008-4449
    49В плане

    Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message.

    КритическаяCVSS 9,3Готовый эксплойтEPSS 38 %

    mirc · mirc6 окт. 2008 г.

  • CVE-2008-4453
    40В плане

    The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 Gd

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    dspicture · light imaging toolkit6 окт. 2008 г.

  • CVE-2008-4384
    46В плане

    Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow re

    КритическаяCVSS 9,3Готовый эксплойтEPSS 28 %

    iseemedia · lpviewer7 окт. 2008 г.

  • CVE-2008-4493
    32Наблюдать

    Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote att

    СредняяCVSS 6,8Proof of conceptEPSS 17 %

    microsoft · digital image8 окт. 2008 г.

  • CVE-2008-4500
    19Наблюдать

    Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafte

    СредняяCVSS 4,0Proof of conceptEPSS 10 %

    solarwinds · serv-u file server8 окт. 2008 г.

  • CVE-2008-4501
    39Наблюдать

    Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to o

    КритическаяCVSS 9,0Proof of conceptEPSS 10 %

    solarwinds · serv-u file server8 окт. 2008 г.

  • CVE-2008-3641
    47В плане

    The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen w

    КритическаяCVSS 10,0Proof of conceptEPSS 24 %

    apple · cups10 окт. 2008 г.

  • CVE-2008-3544
    41В плане

    Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, al

    КритическаяCVSS 9,0Proof of conceptEPSS 18 %

    hp · openview network node manager13 окт. 2008 г.

  • CVE-2008-4546
    37Наблюдать

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denia

    СредняяCVSS 4,3Proof of conceptEPSS 65 %

    adobe · flash player14 окт. 2008 г.

  • CVE-2008-4547
    40В плане

    Heap-based buffer overflow in the PdvrAtl.PdvrOcx.1 ActiveX control (pdvratl.dll) in DVRHOST Web CMS OCX 1.0.1.25 allows remote attackers to

    КритическаяCVSS 9,3Proof of conceptEPSS 11 %

    dvrstation · dvrstation cms14 окт. 2008 г.

  • CVE-2008-4385
    48В плане

    Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of

    КритическаяCVSS 9,3Готовый эксплойтEPSS 37 %

    systemrequirementslab · system requirements lab14 окт. 2008 г.

  • CVE-2008-4397
    64На этой неделе

    Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 throu

    КритическаяCVSS 10,0Готовый эксплойтEPSS 80 %

    ca · arcserve backup14 окт. 2008 г.

  • CVE-2008-3982
    40В плане

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    СредняяCVSS 5,5Готовый эксплойтEPSS 11 %

    oracle · database 10g14 окт. 2008 г.

  • CVE-2008-3983
    40В плане

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    СредняяCVSS 5,5Готовый эксплойтEPSS 41 %

    oracle · database 10g14 окт. 2008 г.

  • CVE-2008-3984
    40В плане

    Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows

    СредняяCVSS 5,5Готовый эксплойтEPSS 41 %

    oracle · database 10g14 окт. 2008 г.

  • CVE-2008-3995
    40В плане

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticat

    СредняяCVSS 5,5Готовый эксплойтEPSS 9 %

    oracle · database 10g14 окт. 2008 г.

  • CVE-2008-3996
    40В плане

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticat

    СредняяCVSS 5,5Готовый эксплойтEPSS 9 %

    oracle · database 10g14 окт. 2008 г.

  • CVE-2008-4008
    57В плане

    Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP

    КритическаяCVSS 10,0Готовый эксплойтEPSS 56 %

    oracle · bea product suite14 окт. 2008 г.

  • CVE-2008-4479
    43В плане

    Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to ex

    КритическаяCVSS 10,0Эксплойта нетEPSS 10 %

    novell · edirectory14 окт. 2008 г.

  • CVE-2008-4480
    43В плане

    Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to ex

    КритическаяCVSS 10,0Эксплойта нетEPSS 10 %

    novell · edirectory14 окт. 2008 г.

  • CVE-2008-4556
    61На этой неделе

    Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers

    КритическаяCVSS 10,0Готовый эксплойтEPSS 69 %

    sun · solaris14 окт. 2008 г.

  • CVE-2008-4557
    54В плане

    plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code v

    КритическаяCVSS 10,0Proof of conceptEPSS 45 %

    cutephp · cutenews14 окт. 2008 г.

  • CVE-2008-1446
    50В плане

    Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on

    КритическаяCVSS 9,0Эксплойта нетEPSS 46 %

    microsoft · internet information services14 окт. 2008 г.

  • CVE-2008-3466
    63На этой неделе

    Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote atta

    КритическаяCVSS 10,0Готовый эксплойтEPSS 77 %

    microsoft · host integration server 200014 окт. 2008 г.

  • CVE-2008-3471
    53В плане

    Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Of

    КритическаяCVSS 9,3Эксплойта нетEPSS 52 %

    microsoft · excel14 окт. 2008 г.

  • CVE-2008-3472
    47В плане

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3473
    47В плане

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3474
    34Наблюдать

    Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att

    СредняяCVSS 6,5Эксплойта нетEPSS 27 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3475
    47В плане

    Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (

    ВысокаяCVSS 8,8Эксплойта нетEPSS 39 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3476
    46В плане

    Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remo

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3477
    48В плане

    Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Off

    КритическаяCVSS 9,3Эксплойта нетEPSS 35 %

    microsoft · internet explorer14 окт. 2008 г.

  • CVE-2008-3479
    53В плане

    Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers

    КритическаяCVSS 10,0Эксплойта нетEPSS 44 %

    microsoft · windows 200014 окт. 2008 г.

  • CVE-2008-4019
    47В плане

    Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 20

    КритическаяCVSS 9,3Эксплойта нетEPSS 34 %

    microsoft · excel14 окт. 2008 г.

  • CVE-2008-4020
    24Наблюдать

    Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a doc

    СредняяCVSS 4,3Эксплойта нетEPSS 24 %

    microsoft · office14 окт. 2008 г.

  • CVE-2008-4023
    52В плане

    Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote at

    КритическаяCVSS 10,0Эксплойта нетEPSS 39 %

    microsoft · windows 200014 окт. 2008 г.

  • CVE-2008-4038
    52В плане

    Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote a

    КритическаяCVSS 10,0Эксплойта нетEPSS 39 %

    microsoft · windows 200014 окт. 2008 г.

  • CVE-2008-4572
    58В плане

    GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary

    КритическаяCVSS 10,0Готовый эксплойтEPSS 60 %

    guildftpd · guildftpd15 окт. 2008 г.

  • CVE-2008-4582
    20Наблюдать

    Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly

    СредняяCVSS 4,3Proof of conceptEPSS 10 %

    mozilla · firefox15 окт. 2008 г.

  • CVE-2008-4587
    40В плане

    Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovisio

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    acresso · flexnet connect15 окт. 2008 г.

  • CVE-2008-4609
    38Наблюдать

    The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operatin

    ВысокаяCVSS 7,1Proof of conceptEPSS 32 %

    bsd · bsd20 окт. 2008 г.

  • CVE-2008-4619
    44В плане

    The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8

    КритическаяCVSS 10,0Proof of conceptEPSS 11 %

    sun · sunos20 окт. 2008 г.

  • CVE-2008-1547
    31Наблюдать

    Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638)

    СредняяCVSS 4,3Proof of conceptEPSS 48 %

    microsoft · exchange server20 окт. 2008 г.

  • CVE-2008-4652
    40В плане

    Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to exec

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    dart · powertcp ftp for activex21 окт. 2008 г.

  • CVE-2008-4654
    54В плане

    Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4

    КритическаяCVSS 9,3Готовый эксплойтEPSS 57 %

    videolan · vlc media player21 окт. 2008 г.

  • CVE-2008-4668
    42В плане

    Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and

    КритическаяCVSS 9,0Proof of conceptEPSS 21 %

    joomla · com imagebrowser22 окт. 2008 г.

  • CVE-2008-4687
    56В плане

    manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP

    КритическаяCVSS 9,0Готовый эксплойтEPSS 67 %

    mantis · mantis22 окт. 2008 г.

  • CVE-2008-4688
    24Наблюдать

    core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source

    СредняяCVSS 5,0Эксплойта нетEPSS 11 %

    mantis · mantis22 окт. 2008 г.

  • CVE-2008-4699
    45В плане

    Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrar

    КритическаяCVSS 9,3Proof of conceptEPSS 27 %

    microsoft · peachtree accounting22 окт. 2008 г.

  • CVE-2008-2469
    47В плане

    Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to exec

    КритическаяCVSS 10,0Proof of conceptEPSS 22 %

    libspf · libspf223 окт. 2008 г.

  • CVE-2008-3862
    46В плане

    Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and

    КритическаяCVSS 10,0Эксплойта нетEPSS 18 %

    trend micro · officescan23 окт. 2008 г.

  • CVE-2008-4250
    99Срочно

    The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a

    КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %

    microsoft · windows 200023 окт. 2008 г.

  • CVE-2008-4696
    40В плане

    Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML vi

    СредняяCVSS 4,3Готовый эксплойтEPSS 45 %

    opera · opera23 окт. 2008 г.

  • CVE-2008-4726
    49В плане

    Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long

    КритическаяCVSS 9,0Proof of conceptEPSS 44 %

    goodtechsystems · goodtech ssh23 окт. 2008 г.

  • CVE-2008-4728
    46В плане

    Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deploym

    КритическаяCVSS 9,3Proof of conceptEPSS 31 %

    hummingbird · deployment wizard23 окт. 2008 г.

  • CVE-2008-4762
    40В плане

    Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially

    КритическаяCVSS 9,0Proof of conceptEPSS 14 %

    freesshd · freesshd27 окт. 2008 г.

  • CVE-2008-4764
    25Наблюдать

    Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read a

    СредняяCVSS 5,0Proof of conceptEPSS 16 %

    extplorer · com extplorer27 окт. 2008 г.

  • CVE-2008-4779
    59В плане

    Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long file

    КритическаяCVSS 10,0Готовый эксплойтEPSS 64 %

    tguzip · tguzip29 окт. 2008 г.

  • CVE-2008-4787
    27Наблюдать

    Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname

    СредняяCVSS 5,8Proof of conceptEPSS 13 %

    microsoft · internet explorer29 окт. 2008 г.

  • CVE-2008-4800
    28Наблюдать

    The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denia

    СредняяCVSS 5,0Proof of conceptEPSS 25 %

    microsoft · debug diagnostic tool30 окт. 2008 г.

  • CVE-2008-4801
    43В плане

    Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler

    КритическаяCVSS 10,0Эксплойта нетEPSS 11 %

    ibm · tivoli storage manager client30 окт. 2008 г.

  • CVE-2008-4864
    36Наблюдать

    Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out o

    ВысокаяCVSS 7,5Proof of conceptEPSS 21 %

    python · python31 окт. 2008 г.