CVE Database - 2008

Browse known vulnerabilities with WAF coverage analysis. See which CVEs are detectable by Web Application Firewalls and their OWASP CRS rules.

4
Matching CVEs
15853
Critical
26962
High
69389
High WAF Coverage
Severity: All Critical (15853) High (26962) Medium (41242) Low (855)
Attack: Authentication Bypass (3246) CSRF (7960) Code Injection (4249) Command Injection (3187) Cross-Site Scripting (XSS) (37475) HTTP Response Splitting (79) Incorrect Authorization (2764) Input Validation (8673) Insecure Deserialization (2555) Missing Authorization (7641) OS Command Injection (5400) Open Redirect (1432) Path Traversal (6855) Privilege Escalation (2590) Remote File Inclusion (1113) Resource Exhaustion (2791) SQL Injection (14737) SSRF (2370) Unrestricted File Upload (3980) XXE (1206)
Year: 1990 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2012 2014 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026
WAF: High (69389) Medium (23730) Low (23337)
Clear filter

CVE-2008-3909

MEDIUM
5.80 CVSS 2.0

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

Cross-Site Request Forgery (CSRF)
WAF: Low

CVE-2008-3511

MEDIUM
4.30 CVSS 2.0

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Image Gallery (Photo Gallery) allow remote attackers to inject arbitrary web script or HTML via the (1) latest parameter to (a) index.php, (b) images.php, (c) suggest_image.php, and (d) image_desc.php; and the (2) msg parameter to index.php, images.php, and suggest_image.php, and (e) index.php, (f) adminhome.php, (g) config.php, (h) changepassword.php, (i) cleanup.php, (j) browsecats.php, and (k) images.php in admin/. NOTE: the image_desc.php/msg vector is covered by CVE-2006-1660. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Cross-Site Scripting (XSS)
WAF: High

CVE-2008-2087

MEDIUM
6.80 CVSS 2.0

SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the host_id parameter, a different vector than CVE-2005-3817.

SQL Injection
WAF: High

CVE-2008-1050

HIGH
7.50 CVSS 2.0

SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.

SQL Injection
WAF: High