CVE-2020-5574
https://notcve.org/view.php?id=CVE-2020-5574
HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary HTML attribute value via unspecified vectors. Una vulnerabilidad de inyección del valor de atributo HTML en la serie Movable Type (Movable Type versiones 7 r.4606 (7.2.1) y anteriores (Movable Type versión 7), Movable Type Advanced versiones 7 r.4606 (7.2.1) y anteriores (Movable Type Advanced versión 7), Movable Type para AWS versiones 7 r.4606 (7.2.1) y anteriores (Movable Type para AWS versión 7), Movable Type versiones 6.5.3 y anteriores (Movable Type versión 6.5), Movable Type Advanced versiones 6.5.3 y anteriores (Movable Type Advanced versión 6.5), Movable Type versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Advanced versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Premium versiones 1.29 y anteriores, y Movable Type Premium Advanced versiones 1.29 y anteriores), permite a atacantes remotos inyectar un valor de atributo HTML arbitrario por medio de vectores no especificados. • https://jvn.jp/en/jp/JVN28806943/index.html https://movabletype.org/news/2020/05/mt-730-660-6312-released.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVE-2020-5575
https://notcve.org/view.php?id=CVE-2020-5575
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary script or HTML via unspecified vectors. Una vulnerabilidad de tipo cross-site scripting en la serie Movable Type (Movable Type versiones 7 r.4606 (7.2.1) y anteriores (Movable Type versión 7), Movable Type Advanced versiones 7 r.4606 (7.2.1) y anteriores (Movable Type Advanced versión 7), Movable Type para AWS versiones 7 r.4606 (7.2.1) y anteriores (Movable Type para AWS versión 7), Movable Type versiones 6.5.3 y anteriores (Movable Type versión 6.5), Movable Type Advanced versiones 6.5.3 y anteriores (Movable Type Advanced versión 6.5), Movable Type versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Advanced versiones 6.3.11 y anteriores (Movable Type versión 6.3), Movable Type Premium versiones 1.29 y anteriores, y Movable Type Premium Advanced versiones 1.29 y anteriores), permite a atacantes remotos inyectar script o HTML arbitrario por medio de vectores no especificados. • https://jvn.jp/en/jp/JVN28806943/index.html https://movabletype.org/news/2020/05/mt-730-660-6312-released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2020-5528
https://notcve.org/view.php?id=CVE-2020-5528
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced 1.26 and earlier (Movable Type Premium Advanced)) allows remote attackers to inject arbitrary web script or HTML in the block editor and the rich text editor via a specially crafted URL. Vulnerabilidad de tipo cross-site scripting en la serie Movable Type (Movable Type 7 versiones r.4603 y anteriores (Movable Type 7), Movable Type versiones 6.5.2 y anteriores (Movable Type 6.5), Movable Type Advanced 7 versiones r.4603 y anteriores (Movable Type Advanced 7), Movable Type Advanced versiones 6.5.2 y anteriores (Movable Type Advanced 6.5), Movable Type Premium versiones 1.26 y anteriores (Movable Type Premium) y Movable Type Premium Advanced versiones 1.26 y anteriores (Movable Type Premium Advanced)), permite a atacantes remotos inyectar script web o HTML arbitrario en el editor de bloques y el editor de texto enriquecido por medio de una URL especialmente diseñada. • http://jvn.jp/en/jp/JVN94435544/index.html https://movabletype.org/news/2020/02/movable_type_r4605_v720_v653_and_v6311_released.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2019-6025
https://notcve.org/view.php?id=CVE-2019-6025
Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium 1.24 and earlier (Movable Type Premium), and Movable Type Premium (Advanced Edition) 1.24 and earlier (Movable Type Premium) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Vulnerabilidad de redireccionamiento abierto en la serie Movable Type Movable Type versión 7 r.4602 (7.1.3) y anteriores (Movable Type versión 7), Movable Type versiones 6.5.0 y 6.5.1 (Movable Type versión 6.5), Movable Type versión 6.3.9 y anteriores (Movable Type versiones 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced versión 7 r.4602 (7.1.3) y anteriores (Movable Type versión 7), Movable Type Advanced versiones 6.5.0 y 6.5.1 (Movable Type versión 6.5), Movable Type Advanced versión 6.3.9 y anterior (Movable Type versiones 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium versión 1.24 y anteriores (Movable Type Premium) y Movable Type Premium (Advanced Edición) versión 1.24 y anteriores (Movable Type Premium), permite a atacantes remotos redireccionar a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing por medio de una URL especialmente diseñada. • http://jvn.jp/en/jp/JVN65280626/index.html https://movabletype.org/news/2019/11/movable_type_r4603_v714_v652_and_v6310_released.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVE-2018-0672
https://notcve.org/view.php?id=CVE-2018-0672
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Movable Type en versiones anteriores a la 6.3.1 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. • http://jvn.jp/en/jp/JVN89550319/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •