CVE-2008-6470

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Multiple unspecified vulnerabilities in ClanSphere before 2008.2.1 allow remote attackers to obtain sensitive information, and possibly have unknown other impact, via vectors related to "javascript insert" and the (1) mods/messages/getusers.php and (2) mods/abcode/listimg.php files. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/48451
http://secunia.com/advisories/31965Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=627530Patch
http://www.clansphere.net/index/news/view/id/289Vendor Advisory
http://www.clansphere.net/index/news/view/id/306Vendor Advisory
http://www.securityfocus.com/bid/31293
https://exchange.xforce.ibmcloud.com/vulnerabilities/45269
http://osvdb.org/48451
http://secunia.com/advisories/31965Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=627530Patch
http://www.clansphere.net/index/news/view/id/289Vendor Advisory
http://www.clansphere.net/index/news/view/id/306Vendor Advisory
http://www.securityfocus.com/bid/31293
https://exchange.xforce.ibmcloud.com/vulnerabilities/45269

Timeline

Published: Mar 13, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-64717.5SQL injection vulnerability in detail.php in MountainGrafix easyLink 1.1.0 allows remote attackers to execute arbitrary SQL commands via the CVE-2008-64724.3The WLCCP dissector in Wireshark 0.99.7 through 1.0.4 allows remote attackers to cause a denial of service (infinite loop) via unspecified v CVE-2008-64736.4_blogadata/include/init_pass2.php in Blogator-script 0.95 allows remote attackers to change the password for arbitrary users via a modified CVE-2008-64749.0The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code CVE-2008-64757.5SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote at CVE-2008-64764.3Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTM CVE-2008-64777.5SQL injection vulnerability in Mumbo Jumbo Media OP4 allows remote attackers to execute arbitrary SQL commands via the id parameter to index CVE-2008-64786.8Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.CVE-2008-64796.8Cross-site request forgery (CSRF) vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swso CVE-2008-64806.8Cross-site request forgery (CSRF) vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack CVE-2008-64817.5SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attackers to execute arbit CVE-2008-64826.8PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_gl