CVE-2008-71343 exploits
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attacke…
Published 17 y ago · modified 4 mo ago · JSON
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a browse action, (4) now parameter, or (5) search parameter in a search_results action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploit prediction (EPSS)
1.52% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
Exploits and detections
- EDB-31391 Chris LaPointe Download Center 1.2 - 'search' Cross-Site Scripting · webapps · 2008-03-12
- EDB-31390 Chris LaPointe Download Center 1.2 - 'category' Cross-Site Scripting · webapps · 2008-03-12
- EDB-31389 Chris LaPointe Download Center 1.2 - login Action Multiple Cross-Site Scripting Vulnerabilities · webapps · 2008-03-12
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securityfocus.com /bid/28219 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/41198 · vdb-entry, x_refsource_XF, x_transferred
- download.redgalaxy.net /?nav=home · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2008-7134
- NVD: CVE-2008-7134
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.