Lhaplus
Vendor:
First CVE: Aug 9, 2006 · Active for 19 years
9
Total CVEs
Bottom 1%
1.5
Avg CVEs / Year
Bottom 1%
6.3
Avg CVSS
Higher Avg CVSS than 1% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Lhaplus over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 9, 2006
19 years ago
Most Recent CVE
Jan 12, 2018
3,119 days ago
CVE Severity & Scoring
Lhaplus9 CVEs
11%
67%
22%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local1 (11.1%)
Network0 (0.0%)
Unknown8 (88.9%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (11.1%)
High0 (0.0%)
Unknown8 (88.9%)
User Interaction
None0 (0.0%)
Unknown8 (88.9%)
Required1 (11.1%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None1 (11.1%)
Unknown8 (88.9%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-2021HIGH Heap-based buffer overflow in Lhaplus before 1.57 allows remote attackers to execute arbitrary code via a long comment field in a ZOO archive. | Apr 30, 2008 | 7.5 | 26 | NO | NO |
CVE-2007-5048HIGH Heap-based buffer overflow in Lhaplus before 1.55 allows remote attackers to execute arbitrary code via a long filename in an ARJ archive. | Sep 24, 2007 | 7.5 | 22 | NO | NO |
CVE-2010-3158MEDIUM Untrusted search path vulnerability in Lhaplus before 1.58 allows local users to gain privileges via a Trojan horse executable file in the current working directory. | Oct 19, 2010 | 6.9 | 21 | NO | NO |
CVE-2010-2368MEDIUM Untrusted search path vulnerability in Lhaplus before 1.58 allows local users to gain privileges via a Trojan horse DLL in the current working directory. | Oct 18, 2010 | 6.9 | 21 | NO | NO |
CVE-2015-0907MEDIUM Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive. | Apr 15, 2015 | 6.8 | 19 | NO | NO |
CVE-2007-6175MEDIUM Buffer overflow in Lhaplus 1.55 and earlier allows remote attackers to execute arbitrary code via a crafted LZH archive, a different vector than CVE-2007-5048. | Nov 30, 2007 | 6.6 | 18 | NO | NO |
Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially crafted ZIP64 archive. | Jan 12, 2018 | 3.3 | 16 | NO | NO |
CVE-2015-0906MEDIUM Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive. | Apr 15, 2015 | 5.8 | 16 | NO | NO |
CVE-2006-4033MEDIUM Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LZH archive with a long header, a | Aug 9, 2006 | 5.1 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Lhaplus
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.57 | 2 | 6.3 | 2.2% | 0 | 0 |
| 1.56 | 4 | 6.6 | 1.2% | 0 | 0 |
| 1.55 | 5 | 6.6 | 1.7% | 0 | 0 |
| 1.53 | 5 | 6.8 | 1.8% | 0 | 0 |
| 1.52 | 6 | 6.5 | 2.3% | 0 | 0 |