CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0672
https://notcve.org/view.php?id=CVE-2018-0672
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Movable Type en versiones anteriores a la 6.3.1 permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. • http://jvn.jp/en/jp/JVN89550319/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2013-2184
https://notcve.org/view.php?id=CVE-2013-2184
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter. Movable Type anterior a 5.2.6 no utiliza correctamente la función Storable::thaw, lo que permite a atacantes remotos ejecutar código arbitrario a través del parámetro comment_state. • http://seclists.org/oss-sec/2013/q2/560 http://seclists.org/oss-sec/2013/q2/568 http://www.debian.org/security/2015/dsa-3183 https://movabletype.org/documentation/appendices/release-notes/movable-type-526-release-notes.html • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 86%CPEs: 6EXPL: 1CVE-2015-1592 – SixApart MovableType < 5.2.12 - Storable Perl Code Execution
https://notcve.org/view.php?id=CVE-2015-1592
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors. Movable Type Pro, Open Source, y Advanced anterior a 5.2.12 y Pro y Advanced 6.0.x anterior a 6.0.7 no utiliza correctamente la función Storable::thaw de Perl, lo que permite a atacantes remotos incluir y ejecutar ficheros locales de Perl arbitrarios y posiblemente ejecutar código arbitrario a través de vectores no especificados. • https://www.exploit-db.com/exploits/41697 http://www.openwall.com/lists/oss-security/2015/02/12/17 http://www.openwall.com/lists/oss-security/2015/02/12/2 http://www.securityfocus.com/bid/72606 http://www.securitytracker.com/id/1031777 https://exchange.xforce.ibmcloud.com/vulnerabilities/100912 https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html https://www.debian.org/security/2015/dsa-3183 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-9057
https://notcve.org/view.php?id=CVE-2014-9057
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la interfaz XML-RPC en Movable Type anterior a 5.18, 5.2.x anterior a 5.2.11, y 6.x anterior a 6.0.6 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/61227 https://movabletype.org/documentation/appendices/release-notes/6.0.6.html https://movabletype.org/news/2014/12/6.0.6.html https://www.debian.org/security/2015/dsa-3183 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 55EXPL: 0CVE-2011-5084
https://notcve.org/view.php?id=CVE-2011-5084
Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Movable Type v4.x anteriores a v4.36 y v5.x anteriores a v5.05, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •