Перейти к содержимому
Noroxi

По дате публикации

Эксплуатируемые и новые серьёзные CVE: февраль 2009 г.

41 записей · 1 KEV. В порядке публикации.

В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.

Границы месяца считаются по UTC, как и дата публикации на странице записи.

  • CVE-2009-0183
    60На этой неделе

    Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers

    КритическаяCVSS 10,0Готовый эксплойтEPSS 66 %

    free download manager · free download manager3 февр. 2009 г.

  • CVE-2009-0184
    45В плане

    Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote

    КритическаяCVSS 9,3Готовый эксплойтEPSS 27 %

    free download manager · free download manager3 февр. 2009 г.

  • CVE-2009-0388
    44В плане

    Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of serv

    КритическаяCVSS 10,0Proof of conceptEPSS 13 %

    tightvnc · tightvnc4 февр. 2009 г.

  • CVE-2009-0419
    25Наблюдать

    Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly r

    СредняяCVSS 5,0Эксплойта нетEPSS 15 %

    microsoft · xml core services4 февр. 2009 г.

  • CVE-2008-6063
    20Наблюдать

    Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" ope

    СредняяCVSS 4,3Эксплойта нетEPSS 10 %

    microsoft · word4 февр. 2009 г.

  • CVE-2008-6080
    23Наблюдать

    Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read

    СредняяCVSS 5,0Proof of conceptEPSS 10 %

    joomla · joomla6 февр. 2009 г.

  • CVE-2008-6082
    40В плане

    Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command.

    СредняяCVSS 5,0Готовый эксплойтEPSS 44 %

    southrivertech · titan ftp server6 февр. 2009 г.

  • CVE-2009-0473
    31Наблюдать

    Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote

    СредняяCVSS 6,8Proof of conceptEPSS 13 %

    rockwellautomation · controllogix 1756-enbt\/a ethernet\/ ip bridge6 февр. 2009 г.

  • CVE-2008-4559
    47В плане

    HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in

    КритическаяCVSS 10,0Эксплойта нетEPSS 24 %

    hp · openview network node manager8 февр. 2009 г.

  • CVE-2009-0476
    48В плане

    Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio compone

    КритическаяCVSS 9,3Готовый эксплойтEPSS 37 %

    multimediasoft · audio dj studio for .net8 февр. 2009 г.

  • CVE-2009-0478
    42В плане

    Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request w

    СредняяCVSS 5,0Proof of conceptEPSS 71 %

    squid · squid8 февр. 2009 г.

  • CVE-2009-0490
    42В плане

    Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other ve

    КритическаяCVSS 9,3Proof of conceptEPSS 16 %

    audacityteam · audacity9 февр. 2009 г.

  • CVE-2009-0450
    40В плане

    Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in

    КритическаяCVSS 9,3Proof of conceptEPSS 10 %

    blazevideo · hdtv player10 февр. 2009 г.

  • CVE-2009-0075
    62На этой неделе

    Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to e

    КритическаяCVSS 9,3Готовый эксплойтEPSS 84 %

    microsoft · internet explorer10 февр. 2009 г.

  • CVE-2009-0076
    47В плане

    Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directiv

    КритическаяCVSS 9,3Proof of conceptEPSS 33 %

    microsoft · internet explorer10 февр. 2009 г.

  • CVE-2009-0095
    44В плане

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly validate object data in Visio files, which allows remote attackers

    КритическаяCVSS 9,3Эксплойта нетEPSS 23 %

    microsoft · visio10 февр. 2009 г.

  • CVE-2009-0096
    44В плане

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly perform memory copy operations for object data, which allows remot

    КритическаяCVSS 9,3Эксплойта нетEPSS 22 %

    microsoft · visio10 февр. 2009 г.

  • CVE-2009-0097
    44В плане

    Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to

    КритическаяCVSS 9,3Эксплойта нетEPSS 22 %

    microsoft · visio10 февр. 2009 г.

  • CVE-2009-0098
    44В плане

    Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encap

    КритическаяCVSS 9,3Эксплойта нетEPSS 24 %

    microsoft · exchange server10 февр. 2009 г.

  • CVE-2009-0099
    28Наблюдать

    The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2,

    СредняяCVSS 5,0Эксплойта нетEPSS 26 %

    microsoft · exchange server10 февр. 2009 г.

  • CVE-2009-0305
    43В плане

    Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry

    КритическаяCVSS 9,3Эксплойта нетEPSS 19 %

    research in motion limited · blackberry application web loader10 февр. 2009 г.

  • CVE-2009-0517
    55В плане

    Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fiel

    КритическаяCVSS 10,0Proof of conceptEPSS 48 %

    phpslash · phpslash10 февр. 2009 г.

  • CVE-2009-0542
    52В плане

    SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (pe

    ВысокаяCVSS 7,5Proof of conceptEPSS 73 %

    proftpd project · proftpd12 февр. 2009 г.

  • CVE-2009-0543
    32Наблюдать

    ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded m

    СредняяCVSS 6,8Proof of conceptEPSS 15 %

    proftpd · proftpd12 февр. 2009 г.

  • CVE-2009-0544
    43В плане

    Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code v

    КритическаяCVSS 10,0Proof of conceptEPSS 11 %

    pycrypto · arc212 февр. 2009 г.

  • CVE-2009-0545
    67На этой неделе

    cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the ty

    КритическаяCVSS 10,0Готовый эксплойтEPSS 90 %

    zeroshell · zeroshell12 февр. 2009 г.

  • CVE-2009-0546
    48В плане

    Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a lon

    КритическаяCVSS 9,3Готовый эксплойтEPSS 36 %

    newsgator · feeddemon12 февр. 2009 г.

  • CVE-2008-6132
    40В плане

    Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers

    СредняяCVSS 6,8Готовый эксплойтEPSS 26 %

    brickhost · phpscheduleit13 февр. 2009 г.

  • CVE-2009-0592
    40В плане

    Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local file

    ВысокаяCVSS 7,5Proof of conceptEPSS 34 %

    pnphpbb · pnphpbb216 февр. 2009 г.

  • CVE-2009-0595
    30Наблюдать

    PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc

    СредняяCVSS 5,1Proof of conceptEPSS 34 %

    phpskelsite · phpskelsite16 февр. 2009 г.

  • CVE-2008-6172
    31Наблюдать

    Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_

    СредняяCVSS 6,8Proof of conceptEPSS 12 %

    joomla · joomla19 февр. 2009 г.

  • CVE-2009-0647
    25Наблюдать

    msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denia

    СредняяCVSS 5,0Эксплойта нетEPSS 17 %

    microsoft · windows live messenger19 февр. 2009 г.

  • CVE-2008-6194
    34Наблюдать

    Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets

    ВысокаяCVSS 7,8Эксплойта нетEPSS 11 %

    microsoft · windows19 февр. 2009 г.

  • CVE-2009-0650
    44В плане

    Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to caus

    КритическаяCVSS 10,0Proof of conceptEPSS 12 %

    tptest · tptest20 февр. 2009 г.

  • CVE-2009-0658
    57В плане

    Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafte

    ВысокаяCVSS 7,8Готовый эксплойтEPSS 87 %

    adobe · acrobat20 февр. 2009 г.

  • CVE-2008-6221
    46В плане

    PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remo

    ВысокаяCVSS 7,5Proof of conceptEPSS 53 %

    joomla · joomla20 февр. 2009 г.

  • CVE-2008-6222
    23Наблюдать

    Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to

    СредняяCVSS 5,0Proof of conceptEPSS 11 %

    joomla · joomla20 февр. 2009 г.

  • CVE-2009-0238
    78На этой неделе

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word

    ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 42 %

    microsoft · excel25 февр. 2009 г.

  • CVE-2009-0187
    49В плане

    Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execut

    КритическаяCVSS 9,3Готовый эксплойтEPSS 39 %

    orbitdownloader · orbit downloader26 февр. 2009 г.

  • CVE-2009-0519
    41В плане

    Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of

    КритическаяCVSS 9,3Эксплойта нетEPSS 14 %

    adobe · air26 февр. 2009 г.

  • CVE-2009-0520
    46В плане

    Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave

    КритическаяCVSS 9,3Proof of conceptEPSS 28 %

    adobe · air26 февр. 2009 г.