CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0672
https://notcve.org/view.php?id=CVE-2018-0672
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Movable Type en versiones anteriores a la 6.3.1 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. • http://jvn.jp/en/jp/JVN89550319/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2013-2184
https://notcve.org/view.php?id=CVE-2013-2184
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter. Movable Type anterior a 5.2.6 no utiliza correctamente la función Storable::thaw, lo que permite a atacantes remotos ejecutar código arbitrario a través del parámetro comment_state. • http://seclists.org/oss-sec/2013/q2/560 http://seclists.org/oss-sec/2013/q2/568 http://www.debian.org/security/2015/dsa-3183 https://movabletype.org/documentation/appendices/release-notes/movable-type-526-release-notes.html • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-9057
https://notcve.org/view.php?id=CVE-2014-9057
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la interfaz XML-RPC en Movable Type anterior a 5.18, 5.2.x anterior a 5.2.11, y 6.x anterior a 6.0.6 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/61227 https://movabletype.org/documentation/appendices/release-notes/6.0.6.html https://movabletype.org/news/2014/12/6.0.6.html https://www.debian.org/security/2015/dsa-3183 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 55EXPL: 0CVE-2011-5084
https://notcve.org/view.php?id=CVE-2011-5084
Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Movable Type v4.x anteriores a v4.36 y v5.x anteriores a v5.05, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 0CVE-2011-5085
https://notcve.org/view.php?id=CVE-2011-5085
Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors. Vulnerabilidad no específica en Movable Type v4.x anteriores a v4.36 y v5.x anteriores a v5.05 permite a atacantes remotos leer y modificar datos a través de vectores no determinados. • http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html •