CVE-2008-2463

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.

• CWE-94

• http://marc.info/?l=bugtraq&m=121915960406986&w=2
• http://secunia.com/advisories/30883
• http://www.exploit-db.com/exploits/6124
• http://www.kb.cert.org/vuls/id/837785US Government Resource
• http://www.microsoft.com/technet/security/advisory/955179.mspx
• http://www.securityfocus.com/bid/30114
• http://www.securitytracker.com/id?1020433
• http://www.us-cert.gov/cas/techalerts/TA08-189A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA08-225A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2012/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43613
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6120
• http://marc.info/?l=bugtraq&m=121915960406986&w=2
• http://secunia.com/advisories/30883
• http://www.exploit-db.com/exploits/6124
• http://www.kb.cert.org/vuls/id/837785US Government Resource
• http://www.microsoft.com/technet/security/advisory/955179.mspx
• http://www.securityfocus.com/bid/30114
• http://www.securitytracker.com/id?1020433
• http://www.us-cert.gov/cas/techalerts/TA08-189A.htmlUS Government Resource
• http://www.us-cert.gov/cas/techalerts/TA08-225A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2008/2012/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43613
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6120

Published

Jul 7, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2457SQL injection vulnerability in jokes_category.php in PHP-Jok…
• CVE-2008-2458Cross-site scripting (XSS) vulnerability in index.php in Sta…
• CVE-2008-2459Directory traversal vulnerability in page.php in Entertainme…
• CVE-2008-2460SQL injection vulnerability in faq.php in vBulletin 3.7.0 Go…
• CVE-2008-2461SQL injection vulnerability in index.php in Netious CMS 0.4 …
• CVE-2008-2462Cross-site scripting (XSS) vulnerability in the viewfile doc…
• CVE-2008-2464The mld_input function in sys/netinet6/mld6.c in the kernel …
• CVE-2008-2468Multiple buffer overflows in the QIP Server Service (aka qip…
• CVE-2008-2469Heap-based buffer overflow in the SPF_dns_resolv_lookup func…
• CVE-2008-2470The InstallShield Update Service Agent ActiveX control in is…
• CVE-2008-2474Buffer overflow in x87 before 3.5.5 in ABB Process Communica…
• CVE-2008-2475eBay Enhanced Picture Uploader ActiveX control (EPUWALcontro…