CVSS: 2.6EPSS: 0%CPEs: 60EXPL: 0CVE-2009-2492
https://notcve.org/view.php?id=CVE-2009-2492
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en mt-wizard.cgi en Six Apart Movable Type anteriores a v4.261, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no específicos, es una vulnerabilidad distinta a CVE-2009-2480. • http://jvn.jp/en/jp/JVN86472161/index.html http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000042.html http://secunia.com/advisories/35534 http://www.securityfocus.com/bid/35885 http://www.vupen.com/english/advisories/2009/1668 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 57EXPL: 0CVE-2009-2481
https://notcve.org/view.php?id=CVE-2009-2481
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors. El archivo mt-wizard.cgi en Movable Type de Six Apart anterior a versión 4.261, cuando las plantillas globales no se inicializan, permite a los atacantes remotos omitir las restricciones de acceso y (1) enviar correo electrónico a direcciones arbitrarias o (2) obtener información confidencial por medio de vectores no especificados. • http://jvn.jp/en/jp/JVN08369659/index.html http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000043.html http://secunia.com/advisories/35534 http://www.securityfocus.com/bid/35471 http://www.vupen.com/english/advisories/2009/1668 https://exchange.xforce.ibmcloud.com/vulnerabilities/51330 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5845
https://notcve.org/view.php?id=CVE-2008-5845
Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Six Apart Movable Type (MT) anterior a v4.23 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, o (4) el campo MTCommenterName en una plantilla Profile View; un (5) listado de pantalla o (6) pantalla de edición en el CMS app; (7) un título TrackBack, relacionado con la librería HTML sanitization; o (8) un archivo de nombre de usuario (también llamado archive title) en una plantilla publicada Community Blog. • http://jvn.jp/en/jp/JVN45658190/index.html http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html http://www.movabletype.org/mt_423_change_log.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5846
https://notcve.org/view.php?id=CVE-2008-5846
Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish posts via a "system-wide entry listing screen." Six Apart Movable Type (MT) anterior a v4.23 permite a usuarios remotos autenticados con permiso para crear entradas destinadas a evitar las restricciones de acceso y publicación de entradas a través de un "system-wide entry listing screen". • http://www.movabletype.org/mt_423_change_log.html http://www.securityfocus.com/bid/33133 https://exchange.xforce.ibmcloud.com/vulnerabilities/47759 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2008-5808
https://notcve.org/view.php?id=CVE-2008-5808
Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise 4.x before 4.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to "application management." Vulnerabilidad de Secuencias de comandos en Sitios Cruzados (XSS) en Six Apart Movable Type Enterprise (MTE) v1.x anteriores a v1.56; Movable Type (MT) v3.x anteriores a v3.38; y Movable Type, Movable Type Open Source (MTOS), y Movable Type Enterprise v4.x anteriores a v4.23, permite a atacantes remotos inyectar secuencias de comandos Web o HTML a través de vectores no especificados, posiblemente esté relacionado con "gestión de la aplicación". • http://jvn.jp/en/jp/JVN02216739/index.html http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000067.html http://secunia.com/advisories/32935 http://www.movabletype.jp/blog/_movable_type_423.html http://www.securityfocus.com/bid/32604 https://exchange.xforce.ibmcloud.com/vulnerabilities/47019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •