EUVD-2008-3380

Malware in sbrugna...

EUVD-2008-3379

Malware in sbrugna...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the 1 gallery and 2 searchstring parameters...

CVE-2008-3394

Multiple cross-site scripting XSS vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the 1 gallery and 2 searchstring parameters...

Sql injection

SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the eventsid parameter...

CVE-2008-3393

SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the eventsid parameter...

CVE-2008-3394

CVE-2008-3394 : In BookMine, multiple cross-site scripting (XSS) vulnerabilities exist in the web app’s search.cfm. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) gallery and (2) search_string parameters. Root cause: insufficient input validation/sanitization...

CVE-2008-3393

The CVE-2008-3393 entry describes an SQL injection in BookMine’s events.cfm, exploitable via the events_id parameter, potentially allowing remote execution of arbitrary SQL commands. Documents confirm the vulnerability’s existence and affected component but do not specify vendor versions, impacte...

CVE-2008-3393

SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the eventsid parameter...

CVE-2008-3394

Multiple cross-site scripting XSS vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the 1 gallery and 2 searchstring parameters...

CVE-2008-3394: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML via the 1 gallery and 2 searchstring parameters...

CVE-2008-3393: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the eventsid parameter...