Page 5 of 55 results (0.005 seconds)

CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0

CVE-2020-5575

https://notcve.org/view.php?id=CVE-2020-5575

Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Una vulnerabilidad de tipo cross-site scripting en la serie Movable Type (Movable Type versiones 7 r.4606 (7.2.1) y anteriores (Movable Type versión 7), Movable Type Advanced versiones 7 r.4606 (7.2.1) y anteriores (Movable Type Advanced versión 7), Movable Type para AWS versiones 7 r.4606 (7.2.1) y anteriores (Movable Type para AWS versión 7), Movable Type versiones 6.5.3 y anteriores (Movable Type versión 6.5), Movable Type Advanced versiones 6.5.3 y anteriores (Movable Type Advanced versión 6.5), Movable Type versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Advanced versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Premium versiones 1.29 y anteriores, y Movable Type Premium Advanced versiones 1.29 y anteriores), permite a atacantes remotos inyectar script o HTML arbitrario por medio de vectores no especificados. • https://jvn.jp/en/jp/JVN28806943/index.html https://movabletype.org/news/2020/05/mt-730-660-6312-released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2020-5528

https://notcve.org/view.php?id=CVE-2020-5528

Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced 1.26 and earlier (Movable Type Premium Advanced)) allows remote attackers to inject arbitrary web script or HTML in the block editor and the rich text editor via a specially crafted URL. Vulnerabilidad de tipo cross-site scripting en la serie Movable Type (Movable Type 7 versiones r.4603 y anteriores (Movable Type 7), Movable Type versiones 6.5.2 y anteriores (Movable Type 6.5), Movable Type Advanced 7 versiones r.4603 y anteriores (Movable Type Advanced 7), Movable Type Advanced versiones 6.5.2 y anteriores (Movable Type Advanced 6.5), Movable Type Premium versiones 1.26 y anteriores (Movable Type Premium) y Movable Type Premium Advanced versiones 1.26 y anteriores (Movable Type Premium Advanced)), permite a atacantes remotos inyectar script web o HTML arbitrario en el editor de bloques y el editor de texto enriquecido por medio de una URL especialmente diseñada. • http://jvn.jp/en/jp/JVN94435544/index.html https://movabletype.org/news/2020/02/movable_type_r4605_v720_v653_and_v6311_released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0

CVE-2019-6025

https://notcve.org/view.php?id=CVE-2019-6025

Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium 1.24 and earlier (Movable Type Premium), and Movable Type Premium (Advanced Edition) 1.24 and earlier (Movable Type Premium) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Vulnerabilidad de redireccionamiento abierto en la serie Movable Type Movable Type versión 7 r.4602 (7.1.3) y anteriores (Movable Type versión 7), Movable Type versiones 6.5.0 y 6.5.1 (Movable Type versión 6.5), Movable Type versión 6.3.9 y anteriores (Movable Type versiones 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced versión 7 r.4602 (7.1.3) y anteriores (Movable Type versión 7), Movable Type Advanced versiones 6.5.0 y 6.5.1 (Movable Type versión 6.5), Movable Type Advanced versión 6.3.9 y anterior (Movable Type versiones 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium versión 1.24 y anteriores (Movable Type Premium) y Movable Type Premium (Advanced Edición) versión 1.24 y anteriores (Movable Type Premium), permite a atacantes remotos redireccionar a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing por medio de una URL especialmente diseñada. • http://jvn.jp/en/jp/JVN65280626/index.html https://movabletype.org/news/2019/11/movable_type_r4603_v714_v652_and_v6310_released.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-0672

https://notcve.org/view.php?id=CVE-2018-0672

Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Movable Type en versiones anteriores a la 6.3.1 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. • http://jvn.jp/en/jp/JVN89550319/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 31EXPL: 0

CVE-2016-5742

https://notcve.org/view.php?id=CVE-2016-5742

SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la interfaz XML-RPC en Movable Type Pro y Advanced 6.x en versiones anteriores a 6.1.3 y 6.2.x en versiones anteriores a 6.2.6 y Movable Type Open Source 5.2.13 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/06/22/3 http://www.openwall.com/lists/oss-security/2016/06/22/5 http://www.openwall.com/lists/oss-security/2016/06/22/6 http://www.securitytracker.com/id/1036160 https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •