CVE-2008-2511

Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEventCli.dll in CA Internet Security Suite 2008 allows remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the argument to the SaveToFile method. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: some of these details are obtained from third party information.

• CWE-22

• http://retrogod.altervista.org/9sg_CA_poc.htmlExploit
• http://secunia.com/advisories/30420Vendor Advisory
• http://www.securityfocus.com/archive/1/492679/100/0/threaded
• http://www.securitytracker.com/id?1020129
• http://www.vupen.com/english/advisories/2008/1696/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42712
• https://www.exploit-db.com/exploits/5682
• http://retrogod.altervista.org/9sg_CA_poc.htmlExploit
• http://secunia.com/advisories/30420Vendor Advisory
• http://www.securityfocus.com/archive/1/492679/100/0/threaded
• http://www.securitytracker.com/id?1020129
• http://www.vupen.com/english/advisories/2008/1696/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42712
• https://www.exploit-db.com/exploits/5682

Published

Jun 2, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2505Cross-site scripting (XSS) vulnerability in result.php in Si…
• CVE-2008-2506Multiple SQL injection vulnerabilities in Simpel Side Weblos…
• CVE-2008-2507Cross-site scripting (XSS) vulnerability in Calcium40.pl in …
• CVE-2008-2508Cross-site scripting (XSS) vulnerability in news.php in Tr S…
• CVE-2008-2509SQL injection vulnerability in pwd.asp in Excuse Online allo…
• CVE-2008-2510SQL injection vulnerability in wp-uploadfile.php in the Uplo…
• CVE-2008-2512Directory traversal vulnerability in Symantec Backup Exec Sy…
• CVE-2008-2513Buffer overflow in the kernel in IBM AIX 5.2, 5.3, and 6.1 a…
• CVE-2008-2514Buffer overflow in errpt in IBM AIX 5.2, 5.3, and 6.1 allows…
• CVE-2008-2515Unspecified vulnerability in iostat in IBM AIX 5.2, 5.3, and…
• CVE-2008-2516pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 doe…
• CVE-2008-2517The sarab.sh script in SaraB before 0.2.4 places the dar pro…