10 results (0.006 seconds)

CVSS: 9.3EPSS: 76%CPEs: 22EXPL: 1

CVE-2007-5348 – Microsoft Internet Explorer - GDI+ (PoC) (MS08-052)

https://notcve.org/view.php?id=CVE-2007-5348

10 Sep 2008 — Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted ... • https://www.exploit-db.com/exploits/6619 • CWE-189: Numeric Errors •

CVSS: 9.3EPSS: 70%CPEs: 22EXPL: 0

CVE-2008-3012

https://notcve.org/view.php?id=CVE-2008-3012

10 Sep 2008 — gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 does not properly perform memory allocation, which allows remote attackers to execute ... • http://marc.info/?l=bugtraq&m=122235754013992&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 9.3EPSS: 71%CPEs: 22EXPL: 0

CVE-2008-3014

https://notcve.org/view.php?id=CVE-2008-3014

10 Sep 2008 — Buffer overflow in gdiplus.dll in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a malformed W... • http://marc.info/?l=bugtraq&m=122235754013992&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 6.1EPSS: 20%CPEs: 50EXPL: 0

CVE-2008-3843

https://notcve.org/view.php?id=CVE-2008-3843

27 Aug 2008 — Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element. Request Validation (tambien conocida como filtros ValidateRequest) en ASP.NET de Microsoft .NET Framework con la actualización MS07-040, no detect... • http://securityreason.com/securityalert/4193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 55%CPEs: 8EXPL: 0

CVE-2008-1456

https://notcve.org/view.php?id=CVE-2008-1456

13 Aug 2008 — Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers. Vulnerabilidad de índice de array en el Sistema de Eventos de Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP1 y SP2, Vista Gold y SP1 y Server 2008 permite a usuarios autentificados remotamente... • http://marc.info/?l=bugtraq&m=121915960406986&w=2 • CWE-20: Improper Input Validation •

CVSS: 9.0EPSS: 51%CPEs: 8EXPL: 0

CVE-2008-1457

https://notcve.org/view.php?id=CVE-2008-1457

13 Aug 2008 — The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate per-user subscriptions, which allows remote authenticated users to execute arbitrary code via a crafted event subscription request. El Sistema de Eventos en Microsoft Windows 2000 SP4, XP SP2 y SP3, Server 2003 SP1 y SP2, Vista Gold y SP1 y Server 2008 no valida correctamente las subscripciones por usuario, lo que permite a usuarios autentificados remotament... • http://marc.info/?l=bugtraq&m=121915960406986&w=2 • CWE-20: Improper Input Validation •

CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 1

CVE-2008-1931

https://notcve.org/view.php?id=CVE-2008-1931

24 Apr 2008 — Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allow local users to create, write, and read registry keys via a crafted IOCTL request. Los Drivers para los Codec de Audio de Realtek HD, RTKVHDA.sys y RTKVHDA64.sys, versiones anteriores a 6.0.1.5605 en Windows Vista, permite a usuarios locales crear, escribir y registrar claves a través de una petición IOCTL manipulada. • http://secunia.com/advisories/29953 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1

CVE-2008-1932

https://notcve.org/view.php?id=CVE-2008-1932

24 Apr 2008 — Integer overflow in Realtek HD Audio Codec Drivers RTKVHDA.sys and RTKVHDA64.sys before 6.0.1.5605 on Windows Vista allows local users to execute arbitrary code via a crafted IOCTL request. Desbordamiento de entero en los controladores RTKVHDA.sys y RTKVHDA64.sys del Codec de audio Realtek HD anterior a la version 6.0.1.5605 en Windows Vista permite a usuarios locales ejecutar código arbitrario mediante la creación de respuestas IOCTL manipuladas. • http://secunia.com/advisories/29953 • CWE-189: Numeric Errors •

CVSS: 9.0EPSS: 61%CPEs: 13EXPL: 2

CVE-2008-1436 – Microsoft Windows - 'SeImpersonatePrivilege' Local Privilege Escalation

https://notcve.org/view.php?id=CVE-2008-1436

21 Apr 2008 — Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service process to capture a resource from a second service process that has a LocalSystem privilege-escalation ability, related to improper management of the SeImpersonatePrivilege user right, as originally reported for Internet Information Services (IIS), aka Token Ki... • https://www.exploit-db.com/exploits/31667 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 2

CVE-2008-1471 – Panda Internet Security/AntiVirus+Firewall 2008 - 'CPoint.sys' Memory Corruption

https://notcve.org/view.php?id=CVE-2008-1471

24 Mar 2008 — The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system crash or kernel panic), overwrite memory, or execute arbitrary code via a crafted IOCTL request that triggers an out-of-bounds write of kernel memory. El dispositivo cpoint.sys driver en Panda Internet Security 2008 y Antivirus+ Firewall 2008 permite a usuarios locales provocar una denegación de servicio (caída del sistema o kernel panic), sobrescribir memoria o ejecutar... • https://www.exploit-db.com/exploits/31363 • CWE-399: Resource Management Errors •