CVE-2008-4918

Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."

• CWE-79

• http://secunia.com/advisories/32498Not Applicable
• http://securityreason.com/securityalert/4556Third Party Advisory
• http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/Third Party Advisory
• http://www.securityfocus.com/archive/1/497948/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497958/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497968/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497989/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/498043/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/498073/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/31998Third Party Advisory, VDB Entry
• http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdfBroken Link
• http://www.vupen.com/english/advisories/2008/2970Permissions Required
• http://www.zerodayinitiative.com/advisories/ZDI-08-070Third Party Advisory, VDB Entry
• http://www.zerodayinitiative.com/advisories/ZDI-08-070/Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46232Third Party Advisory, VDB Entry
• http://secunia.com/advisories/32498Not Applicable
• http://securityreason.com/securityalert/4556Third Party Advisory
• http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/Third Party Advisory
• http://www.securityfocus.com/archive/1/497948/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497958/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497968/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/497989/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/498043/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/498073/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/31998Third Party Advisory, VDB Entry
• http://www.sonicwall.com/downloads/SonicOS_Enhanced_4.0.1.1_Release_Notes.pdfBroken Link
• http://www.vupen.com/english/advisories/2008/2970Permissions Required
• http://www.zerodayinitiative.com/advisories/ZDI-08-070Third Party Advisory, VDB Entry
• http://www.zerodayinitiative.com/advisories/ZDI-08-070/Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46232Third Party Advisory, VDB Entry

Published

Nov 4, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-4912SQL injection vulnerability in popup_img.php in the fotogale…
• CVE-2008-4913Directory traversal vulnerability in admin.php in LokiCMS 0.…
• CVE-2008-4914Unspecified vulnerability in VMware ESXi 3.5 before ESXe350-…
• CVE-2008-4915The CPU hardware emulation in VMware Workstation 6.0.5 and e…
• CVE-2008-4916Unspecified vulnerability in a guest virtual device driver i…
• CVE-2008-4917Unspecified vulnerability in VMware Workstation 5.5.8 and ea…
• CVE-2008-4919Insecure method vulnerability in VISAGESOFT eXPert PDF Viewe…
• CVE-2008-4920Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-4921board/admin/reguser.php in Chipmunk CMS 1.3 allows remote at…
• CVE-2008-4922Buffer overflow in the DjVu ActiveX Control 3.0 for Microsof…
• CVE-2008-4923Multiple insecure method vulnerabilities in MW6 Technologies…
• CVE-2008-4924Multiple insecure method vulnerabilities in MW6 Technologies…