CVE-2008-3353
Last modified
CVE-2008-3353 is a vulnerability of currently unknown severity. Multiple cross-site scripting (XSS) vulnerabilities in Pure Software Lore before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) article comments feature and the (2) search log feature.. EPSS estimates a 1.03% chance of exploitation in the next 30 days.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Pure Software Lore before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) article comments feature and the (2) search log feature.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Puresw | Lore | <= 1.6.3 |
| Puresw | Lore | 1.0.2 |
| Puresw | Lore | 1.0.3 |
| Puresw | Lore | 1.0.4 |
| Puresw | Lore | 1.0.5 |
| Puresw | Lore | 1.0.6 |
| Puresw | Lore | 1.0.7 |
| Puresw | Lore | 1.0.8 |
| Puresw | Lore | 1.0.9 |
| Puresw | Lore | 1.1.0 |
| Puresw | Lore | 1.1.1 |
| Puresw | Lore | 1.1.2 |
| Puresw | Lore | 1.2.0 |
| Puresw | Lore | 1.2.1 |
| Puresw | Lore | 1.3.0 |
| Puresw | Lore | 1.4.0 |
| Puresw | Lore | 1.4.1 |
| Puresw | Lore | 1.4.2 |
| Puresw | Lore | 1.4.3 |
| Puresw | Lore | 1.5.0 |
| Puresw | Lore | 1.5.1 |
| Puresw | Lore | 1.5.2 |
| Puresw | Lore | 1.5.3 |
| Puresw | Lore | 1.5.4 |
| Puresw | Lore | 1.5.5 |
| Puresw | Lore | 1.5.6 |
| Puresw | Lore | 1.5.7 |
| Puresw | Lore | 1.5.8 |
| Puresw | Lore | 1.5.9 |
| Puresw | Lore | 1.6.0 |
| Puresw | Lore | 1.6.1 |
| Puresw | Lore | 1.6.2 |
References
- http://secunia.com/advisories/31217Vendor Advisory
- http://secunia.com/advisories/31217Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-3353?
How severe is CVE-2008-3353?
How do I fix CVE-2008-3353?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-3347SQL injection vulnerability in staticpages/easycalendar/inde…
- CVE-2008-3348Cross-site scripting (XSS) vulnerability in staticpages/easy…
- CVE-2008-3349Multiple unspecified vulnerabilities in NetApp Data ONTAP, a…
- CVE-2008-3350dnsmasq 2.43 allows remote attackers to cause a denial of se…
- CVE-2008-3351SQL injection vulnerability in atomPhotoBlog.php in Atom Pho…
- CVE-2008-3352SQL injection vulnerability in index.php in Live Music Plus …
- CVE-2008-3354Multiple PHP remote file inclusion vulnerabilities in the Ne…
- CVE-2008-3355SQL injection vulnerability in sitemap.xml.php in Camera Lif…
- CVE-2008-3356verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), a…
- CVE-2008-3357Untrusted search path vulnerability in ingvalidpw in Ingres …
- CVE-2008-3358Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) …
- CVE-2008-3359SQL injection vulnerability in register.php in Steve Bourgeo…
Are you affected by CVE-2008-3353?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST