CVSS: 7.1EPSS: 2%CPEs: 2049EXPL: 0CVE-2008-4609
https://notcve.org/view.php?id=CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. La implementación del protocolo TCP en (1) Linux, (2) plataformas basadas en BSD Unix, (3) Microsoft Windows, (4) productos Cisco, y probablemente otros sistemas operativos, permite a atacantes remotos provocar una denegación de servicio (agotamiento de cola de conexión) a través de múltiples vectores que manipulan información en la tabla de estados del TCP, como lo demuestra sockstress. • http://blog.robertlee.name/2008/10/conjecture-speculation.html http://insecure.org/stf/tcp-dos-attack-explained.html http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html http://marc.info/?l=bugtraq&m=125856010926699&w=2 http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml http://www.cisco.com/en/US/products/products_security_response09186a0080a15120.html http://www.cpni • CWE-16: Configuration •
CVSS: 6.8EPSS: 1%CPEs: 10EXPL: 2CVE-2008-3365 – PixelPost 1.7.1 - 'language_full' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-3365
Directory traversal vulnerability in index.php in Pixelpost 1.7.1 on Windows, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language_full parameter. Vulnerabilidad de salto de directorio en index.php en Pixelpost 1.7.1 sobre Windows, cuando "register_globals" está activado, permite a atacantes remotos incluir y ejecutar archivos locales a través de .. (punto punto) en el parámetro "languaje_full". • https://www.exploit-db.com/exploits/6150 http://secunia.com/advisories/31239 http://securityreason.com/securityalert/4062 http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch http://www.securityfocus.com/archive/1/494817/100/0/threaded http://www.securityfocus.com/bid/30397 http://www.vupen.com/english/advisories/2008/2207/references https://exchange.xforce.ibmcloud.com/vulnerabilities/44031 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 1%CPEs: 9EXPL: 0CVE-2008-2306
https://notcve.org/view.php?id=CVE-2008-2306
Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTION_SHELL_EXECUTE_HIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files. Apple Safari anterior a la versión 3.1.2 en Windows no interpreta apropiadamente la configuración de zona de Internet Explorer URLACTION_SHELL_EXECUTE_HIGHRISK, que permite a los atacantes remotos omitir las restricciones de acceso previstas y forzar a un sistema cliente a descargar y ejecutar archivos arbitrarios. • http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html http://secunia.com/advisories/30775 http://www.kb.cert.org/vuls/id/127185 http://www.securityfocus.com/bid/29835 http://www.securitytracker.com/id?1020329 http://www.vupen.com/english/advisories/2008/1882/references • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 18%CPEs: 60EXPL: 0CVE-2008-2307
https://notcve.org/view.php?id=CVE-2008-2307
Unspecified vulnerability in WebKit in Apple Safari before 3.1.2, as distributed in Mac OS X before 10.5.4, and standalone for Windows and Mac OS X 10.4, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors involving JavaScript arrays that trigger memory corruption. Una vulnerabilidad no especificada en WebKit en Apple Safari anterior a la versión 3.1.2, distribuida en Mac OS X anterior a la versión 10.5.4, e independiente para Windows y Mac OS X versión 10.4, permite a los atacantes remotos causar una denegación de servicio (bloqueo de aplicación) o ejecutar código arbitrario por medio de vectores que involucra a la matriz JavaScript que desencadena una corrupción de memoria. • http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html http://lists.apple.com/archives/security-announce/2008//Jun/msg00003.html http://secunia.com/advisories/30775 http://secunia.com/advisories/30801 http://secunia.com/advisories/30992 http://secunia.com/advisories/31074 http://support.apple.com/kb/HT2092 http://support.apple.com/kb/HT2163 http://support.apple.com/kb/HT2165 h • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 3%CPEs: 4EXPL: 0CVE-2008-1024
https://notcve.org/view.php?id=CVE-2008-1024
Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file download with a crafted file name, which triggers memory corruption. Apple Safari versiones anteriores a 3.1.1, cuando se está ejecutando en Windows XP o Vista, permite a atacantes remotos provocar una denegación de servicio (caída) y posíblemente ejecutar código de su elección a través de un fichero descargado con un nombre de fichero manipulado, lo cual dispara una corrupción de memoria. • http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html http://support.apple.com/kb/HT1467 http://www.kb.cert.org/vuls/id/529441 http://www.securityfocus.com/bid/28813 http://www.securitytracker.com/id?1019868 http://www.vupen.com/english/advisories/2008/0979/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41864 • CWE-399: Resource Management Errors •