Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: декабрь 2008 г.

66 записей · 0 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2008-5297
    36Наблюдать

    Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update r

    ВысокаяCVSS 7,6Proof of conceptEPSS 18 %

    vitalwerks · no-ip duc1 дек. 2008 г.

  • CVE-2008-5353
    66На этой неделе

    The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2

    КритическаяCVSS 10,0Готовый эксплойтEPSS 85 %

    sun · jdk5 дек. 2008 г.

  • CVE-2008-5357
    40В плане

    Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK a

    КритическаяCVSS 9,3Эксплойта нетEPSS 10 %

    sun · jre5 дек. 2008 г.

  • CVE-2008-5359
    40В плане

    Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK an

    КритическаяCVSS 9,3Эксплойта нетEPSS 10 %

    sun · jre5 дек. 2008 г.

  • CVE-2008-4310
    35Наблюдать

    httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of s

    ВысокаяCVSS 7,8Proof of conceptEPSS 13 %

    ruby-lang · ruby8 дек. 2008 г.

  • CVE-2008-5405
    51В плане

    Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attac

    КритическаяCVSS 9,3Готовый эксплойтEPSS 46 %

    oxid · cain and abel10 дек. 2008 г.

  • CVE-2008-5409
    40В плане

    Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Securit

    КритическаяCVSS 9,3Proof of conceptEPSS 11 %

    bitdefender · antivirus10 дек. 2008 г.

  • CVE-2008-2249
    46В плане

    Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows r

    КритическаяCVSS 9,3Эксплойта нетEPSS 31 %

    microsoft · windows 200010 дек. 2008 г.

  • CVE-2008-3009
    45В плане

    Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly

    КритическаяCVSS 10,0Эксплойта нетEPSS 15 %

    microsoft · windows media player10 дек. 2008 г.

  • CVE-2008-3010
    45В плане

    Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate

    КритическаяCVSS 10,0Эксплойта нетEPSS 15 %

    microsoft · windows media player10 дек. 2008 г.

  • CVE-2008-3465
    43В плане

    Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and

    КритическаяCVSS 9,8Эксплойта нетEPSS 13 %

    microsoft · windows 200010 дек. 2008 г.

  • CVE-2008-4024
    46В плане

    Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document wit

    КритическаяCVSS 9,3Эксплойта нетEPSS 28 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4025
    47В плане

    Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 G

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4026
    44В плане

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word

    КритическаяCVSS 9,3Эксплойта нетEPSS 23 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4027
    47В плане

    Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word View

    КритическаяCVSS 9,3Эксплойта нетEPSS 33 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4028
    48В плане

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office

    КритическаяCVSS 9,3Эксплойта нетEPSS 38 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4030
    44В плане

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Off

    КритическаяCVSS 9,3Эксплойта нетEPSS 23 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4031
    44В плане

    Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office

    КритическаяCVSS 9,3Эксплойта нетEPSS 23 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4032
    44В плане

    Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorizati

    ВысокаяCVSS 7,5Эксплойта нетEPSS 47 %

    microsoft · office sharepoint server10 дек. 2008 г.

  • CVE-2008-4252
    40В плане

    The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors dur

    ВысокаяCVSS 8,5Эксплойта нетEPSS 20 %

    microsoft · office frontpage10 дек. 2008 г.

  • CVE-2008-4253
    40В плане

    The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office

    ВысокаяCVSS 8,5Эксплойта нетEPSS 20 %

    microsoft · office frontpage10 дек. 2008 г.

  • CVE-2008-4254
    41В плане

    Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 S

    ВысокаяCVSS 8,5Эксплойта нетEPSS 22 %

    microsoft · office frontpage10 дек. 2008 г.

  • CVE-2008-4255
    53В плане

    Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual B

    КритическаяCVSS 9,3Proof of conceptEPSS 53 %

    microsoft · office frontpage10 дек. 2008 г.

  • CVE-2008-4256
    40В плане

    The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 an

    ВысокаяCVSS 8,5Эксплойта нетEPSS 20 %

    microsoft · office frontpage10 дек. 2008 г.

  • CVE-2008-4258
    39Наблюдать

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote

    ВысокаяCVSS 8,5Эксплойта нетEPSS 17 %

    microsoft · internet explorer10 дек. 2008 г.

  • CVE-2008-4259
    47В плане

    Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrar

    КритическаяCVSS 9,3Эксплойта нетEPSS 32 %

    microsoft · internet explorer10 дек. 2008 г.

  • CVE-2008-4260
    40В плане

    Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a c

    ВысокаяCVSS 8,5Эксплойта нетEPSS 19 %

    microsoft · internet explorer10 дек. 2008 г.

  • CVE-2008-4261
    46В плане

    Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not pro

    КритическаяCVSS 9,3Эксплойта нетEPSS 29 %

    microsoft · internet explorer10 дек. 2008 г.

  • CVE-2008-4264
    45В плане

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibili

    КритическаяCVSS 9,3Эксплойта нетEPSS 25 %

    microsoft · office excel10 дек. 2008 г.

  • CVE-2008-4265
    44В плане

    Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed

    КритическаяCVSS 9,3Эксплойта нетEPSS 24 %

    microsoft · office excel10 дек. 2008 г.

  • CVE-2008-4266
    45В плане

    Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 f

    КритическаяCVSS 9,3Эксплойта нетEPSS 27 %

    microsoft · excel10 дек. 2008 г.

  • CVE-2008-4268
    40В плане

    The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation f

    ВысокаяCVSS 8,5Эксплойта нетEPSS 20 %

    microsoft · windows server 200810 дек. 2008 г.

  • CVE-2008-4269
    40В плане

    The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obt

    ВысокаяCVSS 8,5Эксплойта нетEPSS 20 %

    microsoft · windows server 200810 дек. 2008 г.

  • CVE-2008-4837
    48В плане

    Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Off

    КритическаяCVSS 9,3Эксплойта нетEPSS 37 %

    microsoft · office10 дек. 2008 г.

  • CVE-2008-4841
    50В плане

    The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to e

    КритическаяCVSS 9,3Proof of conceptEPSS 43 %

    microsoft · wordpad10 дек. 2008 г.

  • CVE-2008-5416
    62На этой неделе

    Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) S

    КритическаяCVSS 9,0Готовый эксплойтEPSS 87 %

    microsoft · sql server10 дек. 2008 г.

  • CVE-2008-4844
    57В плане

    Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6

    КритическаяCVSS 9,3Готовый эксплойтEPSS 66 %

    microsoft · internet explorer11 дек. 2008 г.

  • CVE-2008-5424
    21Наблюдать

    The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed

    СредняяCVSS 4,3Эксплойта нетEPSS 12 %

    microsoft · outlook express11 дек. 2008 г.

  • CVE-2008-5492
    48В плане

    Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX Control allows remo

    КритическаяCVSS 9,3Готовый эксплойтEPSS 35 %

    verypdf · verydoc pdf viewer12 дек. 2008 г.

  • CVE-2008-5539
    40В плане

    RISING Antivirus 21.06.31.00 and possibly 20.61.42.00, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of

    КритическаяCVSS 9,3Эксплойта нетEPSS 10 %

    rising-global · rising antivirus12 дек. 2008 г.

  • CVE-2008-5551
    21Наблюдать

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS atta

    СредняяCVSS 4,3Proof of conceptEPSS 13 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5552
    20Наблюдать

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS atta

    СредняяCVSS 4,3Эксплойта нетEPSS 11 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5553
    20Наблюдать

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which all

    СредняяCVSS 4,3Эксплойта нетEPSS 11 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5554
    21Наблюдать

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a U

    СредняяCVSS 4,3Эксплойта нетEPSS 14 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5555
    21Наблюдать

    Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which all

    СредняяCVSS 4,3Эксплойта нетEPSS 12 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5556
    20Наблюдать

    The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are e

    СредняяCVSS 4,3Эксплойта нетEPSS 11 %

    microsoft · internet explorer12 дек. 2008 г.

  • CVE-2008-5587
    21Наблюдать

    Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote

    СредняяCVSS 4,3Proof of conceptEPSS 12 %

    phppgadmin · phppgadmin16 дек. 2008 г.

  • CVE-2008-5081
    40В плане

    The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attacker

    СредняяCVSS 5,0Готовый эксплойтEPSS 59 %

    avahi · avahi16 дек. 2008 г.

  • CVE-2008-5619
    58В плане

    html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2

    КритическаяCVSS 10,0Proof of conceptEPSS 58 %

    roundcube · webmail16 дек. 2008 г.

  • CVE-2008-5626
    40В плане

    XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command,

    СредняяCVSS 4,0Готовый эксплойтEPSS 35 %

    dxmsoft · xm easy personal ftp server17 дек. 2008 г.

  • CVE-2008-5499
    61На этой неделе

    Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrar

    КритическаяCVSS 9,3Готовый эксплойтEPSS 79 %

    adobe · flash player for linux17 дек. 2008 г.

  • CVE-2008-5664
    48В плане

    Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to

    КритическаяCVSS 9,3Готовый эксплойтEPSS 36 %

    realtek · realtek media player18 дек. 2008 г.

  • CVE-2008-5666
    40В плане

    WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of service via a sequence

    НизкаяCVSS 3,5Готовый эксплойтEPSS 20 %

    wftpserver · winftp ftp server18 дек. 2008 г.

  • CVE-2008-5692
    24Наблюдать

    Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read

    СредняяCVSS 5,0Proof of conceptEPSS 12 %

    ipswitch · ws ftp19 дек. 2008 г.

  • CVE-2008-5695
    38Наблюдать

    wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option,

    ВысокаяCVSS 8,5Proof of conceptEPSS 12 %

    wordpress · wordpress19 дек. 2008 г.

  • CVE-2008-5711
    47В плане

    Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary c

    КритическаяCVSS 9,3Готовый эксплойтEPSS 32 %

    facebook · photouploader24 дек. 2008 г.

  • CVE-2008-5722
    44В плане

    Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execut

    КритическаяCVSS 10,0Proof of conceptEPSS 14 %

    sawstudio · sawstudio26 дек. 2008 г.

  • CVE-2008-5732
    34Наблюдать

    Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute arbitrary code by upl

    ВысокаяCVSS 7,5Proof of conceptEPSS 13 %

    kafooeyblog · kafooeyblog26 дек. 2008 г.

  • CVE-2008-5745
    23Наблюдать

    Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, including 11.0.5721.5260,

    СредняяCVSS 4,3Proof of conceptEPSS 21 %

    microsoft · windows media player29 дек. 2008 г.

  • CVE-2008-5748
    35Наблюдать

    Directory traversal vulnerability in plugins/spaw2/dialogs/dialog.php in BloofoxCMS 0.3.4 allows remote attackers to read arbitrary files vi

    ВысокаяCVSS 8,1Proof of conceptEPSS 10 %

    bloofox · bloofoxcms29 дек. 2008 г.

  • CVE-2008-5750
    33Наблюдать

    Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary comm

    СредняяCVSS 6,8Proof of conceptEPSS 21 %

    microsoft · internet explorer29 дек. 2008 г.

  • CVE-2008-5763
    42В плане

    PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to e

    ВысокаяCVSS 7,5Proof of conceptEPSS 39 %

    mariovaldez · simple text-file login script30 дек. 2008 г.

  • CVE-2008-5764
    51В плане

    PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows remote attackers to ex

    КритическаяCVSS 9,3Proof of conceptEPSS 45 %

    2500mhz · worksimple30 дек. 2008 г.

  • CVE-2008-5789
    43В плане

    Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow re

    ВысокаяCVSS 7,5Proof of conceptEPSS 44 %

    recly · interactive feederator31 дек. 2008 г.

  • CVE-2008-5790
    41В плане

    Multiple PHP remote file inclusion vulnerabilities in the Recly!Competitions (com_competitions) component 1.0 for Joomla! allow remote attac

    ВысокаяCVSS 7,5Proof of conceptEPSS 36 %

    recly · competitions31 дек. 2008 г.

  • CVE-2008-5793
    34Наблюдать

    Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for Joomla! allow remote

    СредняяCVSS 6,8Proof of conceptEPSS 24 %

    joomla · joomla31 дек. 2008 г.