CVE-2008-0379

highpriority · attend · 50EPSS 0.086 · 95 %ileexploit · functionalEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · functional

Likely / severe?

8.56% (95th) EPSS

CVSS 9.3 · high

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

enisa_euvd · nvd

EPSS · scored 2026-10-28

Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 10

v2.08.4highAV:N/AC:M/Au:N/C:C/I:C/A:C/E:POCsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USprimaryCWE-362USprimary

exploits (1)

Public proof-of-concept and weaponised exploit code.

EDB-4931Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)functional · exploit_db

affected products (2)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
businessobjects crystal reports xi= r2nvdUScpe:2.3:a:businessobjects:crystal_reports_xi:*:*:*:*:*:*:*:*

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd NVD CVE.org MITRE

published 2008-01-22modified 2026-06-16

related (9,815)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-43520US	medium5.5OT critical	0.43% (37th)	KEV	2025-12-12
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS So…
CVE-2025-62215US	—OT critical	4.46% (91st)	KEV	2025-11-11
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2025-39964US	medium5.5OT critical	1.57% (75th)	KEV	2025-10-13
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is…
CVE-2025-20333US	—OT critical	71.2% (99th)	KEV	2025-09-25
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an aut…
CVE-2025-39682US	critical9.8OT critical	3.25% (88th)	KEV	2025-09-05
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contig…

+9810 more

references (8)

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/27333 enisa_euvd
http://www.securitytracker.com/id?1019239 enisa_euvd
https://exchange.xforce.ibmcloud.com/vulnerabilities/39743 enisa_euvd
https://www.exploit-db.com/exploits/4931 enisa_euvd
http://www.securityfocus.com/bid/27333Broken LinkExploitThird Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id?1019239Broken LinkThird Party AdvisoryVDB Entrynvd
https://exchange.xforce.ibmcloud.com/vulnerabilities/39743Third Party AdvisoryVDB Entrynvd
https://www.exploit-db.com/exploits/4931ExploitThird Party AdvisoryVDB Entrynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan