Security Vulnerabilities Published In July 2008 (CVSS score >= 7)

2008 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2007-5400	119	Exec Code Overflow	2008-07-28	2018-10-30	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the Shockwave Flash (SWF) frame handling in RealNetworks RealPlayer 10.5 Build 6.0.12.1483 might allow remote attackers to execute arbitrary code via a crafted SWF file.
2	CVE-2008-0086	119	Exec Code Overflow	2008-07-08	2018-10-15	9.0	None	Remote	Low	???	Complete	Complete	Complete
Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.
3	CVE-2008-0106	119	Exec Code Overflow	2008-07-08	2018-10-15	9.0	None	Remote	Low	???	Complete	Complete	Complete
Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.
4	CVE-2008-0107	189	Exec Code Overflow Mem. Corr.	2008-07-08	2019-02-26	9.0	None	Remote	Low	???	Complete	Complete	Complete
Integer underflow in SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 allows remote authenticated users to execute arbitrary code via a (1) SMB or (2) WebDAV pathname for an on-disk file (aka stored backup file) with a crafted record size value, which triggers a heap-based buffer overflow, aka "SQL Server Memory Corruption Vulnerability."
5	CVE-2008-1435	94	Exec Code	2008-07-08	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Windows Explorer in Microsoft Windows Vista up to SP1, and Server 2008, allows user-assisted remote attackers to execute arbitrary code via crafted saved-search (.search-ms) files that are not properly handled when saving, aka "Windows Saved Search Vulnerability."
6	CVE-2008-1454			2008-07-08	2019-02-26	9.4	None	Remote	Low	Not required	None	Complete	Complete
Unspecified vulnerability in Microsoft DNS in Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 allows remote attackers to conduct cache poisoning attacks via unknown vectors related to accepting "records from a response that is outside the remote server's authority," aka "DNS Cache Poisoning Vulnerability," a different vulnerability than CVE-2008-1447.
7	CVE-2008-1665		Exec Code	2008-07-17	2017-08-08	9.0	None	Remote	Low	???	Complete	Complete	Complete
Multiple unspecified vulnerabilities in HP Select Identity (HPSI) Active Directory Bidirectional LDAP Connector 2.20, 2.20.001, 2.20.002, and 2.30 allow remote attackers to execute arbitrary code via unspecified vectors.
8	CVE-2008-1666			2008-07-17	2011-03-08	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in HP Oracle for OpenView (OfO) 8.1.7, 9.1.01, 9.2, 9.2.0, 10g, and 10gR2 has unknown impact and attack vectors, possibly related to the July 2008 Oracle Critical Patch Update.
9	CVE-2008-1667	189		2008-07-29	2017-08-08	7.8	None	Remote	Low	Not required	None	None	Complete
The Probe Builder Service (aka PBOVISServer.exe) in European Performance Systems (EPS) Probe Builder 2.2 before A.02.20.901, as used in HP OpenView Internet Services (OVIS) on Windows, allows remote attackers to kill arbitrary processes via a process ID number in an unspecified opcode.
10	CVE-2008-1676	255	Bypass	2008-07-07	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
11	CVE-2008-1809	119	Exec Code Overflow	2008-07-14	2017-08-08	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in Novell eDirectory 8.7.3 before 8.7.3.10b, and 8.8 before 8.8.2 FTF2, allows remote attackers to execute arbitrary code via an LDAP search request containing "NULL search parameters."
12	CVE-2008-2244	399	Exec Code	2008-07-09	2017-09-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited in the wild in July 2008, and as demonstrated by attachement.doc.
13	CVE-2008-2303	189	DoS Exec Code	2008-07-14	2017-08-08	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a different vulnerability than CVE-2008-2307.
14	CVE-2008-2311	362	Exec Code	2008-07-01	2017-08-08	7.6	None	Remote	High	Not required	Complete	Complete	Complete
Launch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote attackers to execute arbitrary code via a symlink attack, probably related to a race condition and automatic execution of a downloaded file.
15	CVE-2008-2317	399	DoS Exec Code	2008-07-14	2018-10-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.
16	CVE-2008-2371	119	DoS Exec Code Overflow	2008-07-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
17	CVE-2008-2374	20	DoS	2008-07-07	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
18	CVE-2008-2375	399	DoS	2008-07-09	2018-10-11	7.1	None	Remote	Medium	Not required	None	None	Complete
Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962.
19	CVE-2008-2376	189	DoS Overflow	2008-07-09	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.
20	CVE-2008-2430	189	Exec Code Overflow	2008-07-07	2018-10-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in the Open function in modules/demux/wav.c in VLC Media Player 0.8.6h on Windows allows remote attackers to execute arbitrary code via a large fmt chunk in a WAV file.
21	CVE-2008-2579			2008-07-15	2020-10-14	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
22	CVE-2008-2597			2008-07-15	2012-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in the TimesTen Client/Server component in Oracle Times Ten In-Memory Database 7.0.3.0.0 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-2598 and CVE-2008-2599.
23	CVE-2008-2598			2008-07-15	2012-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in the TimesTen Client/Server component in Oracle Times Ten In-Memory Database 7.0.3.0.0 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-2597 and CVE-2008-2599.
24	CVE-2008-2599			2008-07-15	2012-10-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in the TimesTen Client/Server component in Oracle Times Ten In-Memory Database 7.0.3.0.0 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-2597 and CVE-2008-2598.
25	CVE-2008-2798	399	DoS Exec Code	2008-07-07	2018-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.
26	CVE-2008-2799	399	DoS Exec Code	2008-07-07	2018-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
27	CVE-2008-2801	287	Exec Code	2008-07-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via (1) injection of JavaScript into documents within a JAR archive or (2) a JAR archive that uses relative URLs to JavaScript files.
28	CVE-2008-2802	264	Exec Code	2008-07-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote attackers to execute arbitrary code via an XUL document that includes a script from a chrome: URI that points to a fastload file, related to this file's "privilege level."
29	CVE-2008-2806	20	Bypass	2008-07-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin (JEP) and Java LiveConnect.
30	CVE-2008-2811	399	DoS Exec Code Overflow	2008-07-07	2018-10-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The block reflow implementation in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image whose display requires more pixels than nscoord_MAX, related to nsBlockFrame::DrainOverflowLines.
31	CVE-2008-2812	476	DoS +Priv	2008-07-09	2020-08-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.
32	CVE-2008-2931	269	DoS +Priv	2008-07-09	2020-08-06	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.
33	CVE-2008-2950	94	Exec Code	2008-07-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not initialized by a Page constructor, which allows remote attackers to execute arbitrary code via a crafted PDF document.
34	CVE-2008-2954	20	DoS	2008-07-01	2017-08-08	7.8	None	Remote	Low	Not required	None	None	Complete
client/NmdcHub.cpp in Linux DC++ (linuxdcpp) before 0.707 allows remote attackers to cause a denial of service (crash) via an empty private message, which triggers an out-of-bounds read.
35	CVE-2008-2959	119	Exec Code Overflow	2008-07-02	2017-09-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might allow remote attackers to execute arbitrary code via a long lpstrLinkPath argument to the fCreateShellLink function.
36	CVE-2008-2964	89	Exec Code Sql	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
37	CVE-2008-2966	22	Dir. Trav.	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in viewprofile.php in JaxUltraBB 2.0 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the user parameter. party information.
38	CVE-2008-2968	89	Exec Code Sql	2008-07-02	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in rating.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
39	CVE-2008-2970	20		2008-07-02	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/.
40	CVE-2008-2971	89	Exec Code Sql	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in links-extern.php in CiBlog 3.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
41	CVE-2008-2972	89	Exec Code Sql	2008-07-02	2017-10-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in index.php in KbLance allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a comment action.
42	CVE-2008-2977	94	Exec Code File Inclusion	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in Ourvideo CMS 9.5 allow remote attackers to execute arbitrary PHP code via a URL in the include_connection parameter to (1) edit_top_feature.php and (2) edit_topics_feature.php in phpi/.
43	CVE-2008-2983	89	Exec Code Sql	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in index.php in Demo4 CMS 01 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
44	CVE-2008-2986	94	Exec Code File Inclusion	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the ourlinux_root_path parameter to (1) adodb-errorpear.inc.php and (2) adodb-pear.inc.php in adodb/.
45	CVE-2008-2988	20		2008-07-02	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unrestricted file upload vulnerability in admin/upload.php in Benja CMS 0.1 allows remote attackers to upload and execute arbitrary PHP files via unspecified vectors, followed by a direct request to the file in billeder/.
46	CVE-2008-2989	89	Exec Code Sql	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in index.php in HoMaP-CMS 0.1 allows remote attackers to execute arbitrary SQL commands via the go parameter.
47	CVE-2008-2990	94	Exec Code File Inclusion	2008-07-02	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compath parameter.
48	CVE-2008-2993	22	Dir. Trav.	2008-07-03	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) fog_lang and (2) fog_skin parameters, probably related to libs/required/share.inc; and possibly the (3) fog_pseudo, (4) fog_posted, (5) fog_password, and (6) fog_cook parameters.
49	CVE-2008-2995	89	Exec Code Sql	2008-07-03	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to execute arbitrary SQL commands via (1) the annuaire parameter to annuaire.php or (2) the username field in admin/login.php.
50	CVE-2008-2999	89	Exec Code Sql	2008-07-03	2017-08-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

Total number of vulnerabilities : 238 Page : 1 (This Page)2 3 4 5