CVSS: 9.3EPSS: 42%CPEs: 7EXPL: 0CVE-2008-2253
https://notcve.org/view.php?id=CVE-2008-2253
10 Sep 2008 — Unspecified vulnerability in Microsoft Windows Media Player 11 allows remote attackers to execute arbitrary code via a crafted audio-only file that is streamed from a Server-Side Playlist (SSPL) on Windows Media Server, aka "Windows Media Player Sampling Rate Vulnerability." Vulnerabilidad sin especificar en Microsoft Windows Media Player 11, permite a atacantes remotos ejecutar código de su elección a través de un archivo "audio-only" manipulado cuyo origen del flujo es un Server-Side Playlist (SSPL) sobre... • http://marc.info/?l=bugtraq&m=122235754013992&w=2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 76%CPEs: 22EXPL: 1CVE-2007-5348 – Microsoft Internet Explorer - GDI+ (PoC) (MS08-052)
https://notcve.org/view.php?id=CVE-2007-5348
10 Sep 2008 — Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted ... • https://www.exploit-db.com/exploits/6619 • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 70%CPEs: 22EXPL: 0CVE-2008-3012
https://notcve.org/view.php?id=CVE-2008-3012
10 Sep 2008 — gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 does not properly perform memory allocation, which allows remote attackers to execute ... • http://marc.info/?l=bugtraq&m=122235754013992&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 71%CPEs: 22EXPL: 0CVE-2008-3014
https://notcve.org/view.php?id=CVE-2008-3014
10 Sep 2008 — Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed W... • http://marc.info/?l=bugtraq&m=122235754013992&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 80%CPEs: 11EXPL: 2CVE-2008-3008 – Microsoft Windows Media Encoder 9 - 'wmex.dll' ActiveX Buffer Overflow (MS08-053)
https://notcve.org/view.php?id=CVE-2008-3008
10 Sep 2008 — Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9 Series allows remote attackers to execute arbitrary code via a long first argument to the GetDetailsString method, aka "Windows Media Encoder Buffer Overrun Vulnerability." Desbordamiento de búfer basado en pila en el control WMEncProfileManager ActiveX en wmex.dll en Microsoft Windows Media Encoder 9 Series permite a atacantes remotos ejecutar un código arbitrario a través de un primer ar... • https://www.exploit-db.com/exploits/16521 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 19%CPEs: 45EXPL: 0CVE-2008-3842
https://notcve.org/view.php?id=CVE-2008-3842
27 Aug 2008 — Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "
CVSS: 6.1EPSS: 20%CPEs: 50EXPL: 0CVE-2008-3843
https://notcve.org/view.php?id=CVE-2008-3843
27 Aug 2008 — Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element. Request Validation (tambien conocida como filtros ValidateRequest) en ASP.NET de Microsoft .NET Framework con la actualización MS07-040, no detect... • http://securityreason.com/securityalert/4193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 55%CPEs: 8EXPL: 0CVE-2008-1456
https://notcve.org/view.php?id=CVE-2008-1456
13 Aug 2008 — Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers. Vulnerabilidad de índice de array en el Sistema de Eventos de Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP1 y SP2, Vista Gold y SP1 y Server 2008 permite a usuarios autentificados remotamente... • http://marc.info/?l=bugtraq&m=121915960406986&w=2 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 51%CPEs: 8EXPL: 0CVE-2008-1457
https://notcve.org/view.php?id=CVE-2008-1457
13 Aug 2008 — The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate per-user subscriptions, which allows remote authenticated users to execute arbitrary code via a crafted event subscription request. El Sistema de Eventos en Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP1 y SP2, Vista Gold y SP1 y Server 2008 no valida correctamente las subscripciones por usuario, lo que permite a usuarios autentificados remotament... • http://marc.info/?l=bugtraq&m=121915960406986&w=2 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 53%CPEs: 3EXPL: 0CVE-2008-2246
https://notcve.org/view.php?id=CVE-2008-2246
13 Aug 2008 — Microsoft Windows Vista through SP1 and Server 2008 do not properly import the default IPsec policy from a Windows Server 2003 domain to a Windows Server 2008 domain, which prevents IPsec rules from being enforced and allows remote attackers to bypass intended access restrictions. Microsoft Windows Vista SP1 y Server 2008 no importan de forma apropiada la política IPsec por defecto de un dominio Windows 2003 Server, lo que evita que las reglas de IPsec puedan ser reforzadas y permite a los atacantes que evi... • http://marc.info/?l=bugtraq&m=121915960406986&w=2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •