6 results (0.009 seconds)

CVSS: 7.5EPSS: 5%CPEs: 19EXPL: 0

CVE-2015-0845

https://notcve.org/view.php?id=CVE-2015-0845

Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates. Vulnerabilidad de la cadena de formatos en Movable Type Pro, Open Source, y Advanced anterior a 5.2.13 y Pro y Advanced 6.0.x anterior a 6.0.8 permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con la localización de plantillas. • http://www.debian.org/security/2015/dsa-3227 http://www.securitytracker.com/id/1032153 https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 3.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2014-5313

https://notcve.org/view.php?id=CVE-2014-5313

Cross-site scripting (XSS) vulnerability in the management page in Six Apart Movable Type before 5.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la página de gestión en Six Apart Movable Type anterior a 5.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN73357573/370331/index.html http://jvn.jp/en/jp/JVN73357573/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0

CVE-2010-3921

https://notcve.org/view.php?id=CVE-2010-3921

Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Movable Type v4.x anterior v4.35 y v5.x anterior v5.04 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no especificados. • http://jvn.jp/en/jp/JVN36673836/index.html http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000060.html http://secunia.com/advisories/42539 http://www.movabletype.org/documentation/appendices/release-notes/movable-type-504-435-release-notes.html http://www.securitytracker.com/id?1024833 http://www.vupen.com/english/advisories/2010/3145 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 0

CVE-2010-4511

https://notcve.org/view.php?id=CVE-2010-4511

Unspecified vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 has unknown impact and attack vectors related to the "dynamic publishing error message." Vulnerabilidad no especificada en Movable Type 4.x en versiones anteriores a la 4.35 y 5.x en versiones anteriores a la 5.04 tiene un impacto y unos vectores de ataque desconocidos relacionados con el "mensaje de error de publicación dinámica". • http://osvdb.org/69751 http://www.movabletype.org/documentation/appendices/release-notes/movable-type-504-435-release-notes.html http://www.securityfocus.com/bid/45380 https://exchange.xforce.ibmcloud.com/vulnerabilities/64129 •

CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0

CVE-2010-3922

https://notcve.org/view.php?id=CVE-2010-3922

SQL injection vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Movable Type v4.x anterior v4.35 y v5.x anterior v5.04 permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no especificados. • http://jvn.jp/en/jp/JVN78536512/index.html http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000061.html http://secunia.com/advisories/42539 http://www.movabletype.org/documentation/appendices/release-notes/movable-type-504-435-release-notes.html http://www.securitytracker.com/id?1024833 http://www.vupen.com/english/advisories/2010/3145 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •