CVSS: 10.0EPSS: 55%CPEs: 2EXPL: 0CVE-2008-3862
https://notcve.org/view.php?id=CVE-2008-3862
Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request containing crafted form data, related to "parsing CGI requests." Desbordamiento de búfer basado en pila en el programa CGI en el servidor de Trend Micro OfficeScan 7.3 Patch 4 build 1367 y otras compilaciones anteriores a 1374, y 8.0 SP1 Patch 1 compilaciones anteriores a 3110, permite a atacantes remotos ejecutar código de su elección a través de peticiones HTTP POST que contienen datos de formulario manipulados, relacionado con el "parseado de peticiones CGI". • http://secunia.com/advisories/32005 http://secunia.com/secunia_research/2008-40 http://securityreason.com/securityalert/4489 http://www.securityfocus.com/archive/1/497650/100/0/threaded http://www.securityfocus.com/bid/31859 http://www.securitytracker.com/id?1021093 http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_CriticalPatch_B1374_readme.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_sp1p1_CriticalPatch_B3110_readme.txt http://www.vupen.com/english/advisorie • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 12%CPEs: 2EXPL: 0CVE-2008-4402
https://notcve.org/view.php?id=CVE-2008-4402
Multiple buffer overflows in CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to execute arbitrary code via unspecified vectors. Múltiples desbordamientos de búfer en los módulos CGI el servidor de Trend Micro OfficeScan v8.0 SP1 anterior a la b2439 y v8.0 SP1 Patch 1 anterior a b3087, permite a atacantes remotos ejecutar código a través de vectores no especificados. • http://secunia.com/advisories/32097 http://www.securityfocus.com/bid/31531 http://www.securitytracker.com/id?1020974 http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3087_Readme.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2439_Readme.txt http://www.vupen.com/english/advisories/2008/2712 https://exchange.xforce.ibmcloud.com/vulnerabilities/45608 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 4%CPEs: 2EXPL: 0CVE-2008-4403
https://notcve.org/view.php?id=CVE-2008-4403
The CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via crafted HTTP headers, related to the "error handling mechanism." El módulo CGI en el servidor en Trend Micro OfficeScan v8.0 SP1 versiones anteriores a build 2439 y v8.0 SP1 Patch 1 versiones anteriores a build 3087 permite a atacantes remotos provocar una denegación de servicio (puntero de referencia NULL y caída del proceso hijo) a través de cabeceras HTTP manipuladas, relacionado con "mecanismo de manejo de errores". • http://secunia.com/advisories/32097 http://www.securityfocus.com/bid/31531 http://www.securitytracker.com/id?1020974 http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3087_Readme.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2439_Readme.txt http://www.vupen.com/english/advisories/2008/2712 https://exchange.xforce.ibmcloud.com/vulnerabilities/45599 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 2%CPEs: 4EXPL: 0CVE-2008-2439 – TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access
https://notcve.org/view.php?id=CVE-2008-2439
Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372, OfficeScan 8.0 SP1 before build 1222, OfficeScan 8.0 SP1 Patch 1 before build 3087, and Worry-Free Business Security 5.0 before build 1220 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP request. NOTE: some of these details are obtained from third party information. Vulnerabilidad de salto de directorio en la función UpdateAgent en TmListen.exe en el servicio OfficeScanNT Listener del cliente de Trend Micro OfficeScan v7.3 Patch 4 build v1367 y otros builds versiones anteriores a v1372, OfficeScan 8.0 SP1 versiones anteriores a build v1222, OfficeScan 8.0 SP1 Patch 1 versiones anteriores a build 3087, y Worry-Free Business Security 5.0 versiones anteriores a build v1220 permite a atacantes remotos leer ficheros de su elección a través de secuencias de salto de directorio en una petición HTTP. NOTA: algunos de estos detalles han sido obtenidos a partir de la información de terceros. • http://secunia.com/advisories/31343 http://secunia.com/advisories/32097 http://secunia.com/secunia_research/2008-39 http://www.securityfocus.com/archive/1/496970/100/0/threaded http://www.securityfocus.com/bid/31531 http://www.securitytracker.com/id?1020975 http://www.trendmicro.com/ftp/documentation/readme/OSCE8.0_SP1_Patch1_CriticalPatch_3087_Readme.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1372_Readme.txt http://www.trendmicro.com/ftp/ • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 82%CPEs: 9EXPL: 0CVE-2008-2437
https://notcve.org/view.php?id=CVE-2008-2437
Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4 build 1362 and other builds, OfficeScan 8.0 and 8.0 SP1, and Client Server Messaging Security 3.6 allows remote attackers to execute arbitrary code via an HTTP request containing a long ComputerName parameter. Desbordamiento de búfer basado en pila en cgiRecvFile.exe en Trend Micro OfficeScan 7.3 patch 4 build 1362 y otras, OfficeScan 8.0 y 8.0 SP1, y Client Server Messaging Security 3.6, permite a atacantes remotos ejecutar código de su elección a través de peticiones HTTP que contienen un parámetro largo "ComputerName". • http://secunia.com/advisories/31342 http://secunia.com/secunia_research/2008-35 http://securityreason.com/securityalert/4263 http://www.securityfocus.com/archive/1/496281/100/0/threaded http://www.securityfocus.com/bid/31139 http://www.securitytracker.com/id?1020860 http://www.trendmicro.com/ftp/documentation/readme/CSM_3.6_OSCE_7.6_Win_EN_CriticalPatch_B1195_readme.txt http://www.trendmicro.com/ftp/documentation/readme/OSCE_7.3_Win_EN_CriticalPatch_B1367_readme.txt http://www.t • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •