CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2014-9057
https://notcve.org/view.php?id=CVE-2014-9057
SQL injection vulnerability in the XML-RPC interface in Movable Type before 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la interfaz XML-RPC en Movable Type anterior a 5.18, 5.2.x anterior a 5.2.11, y 6.x anterior a 6.0.6 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://secunia.com/advisories/61227 https://movabletype.org/documentation/appendices/release-notes/6.0.6.html https://movabletype.org/news/2014/12/6.0.6.html https://www.debian.org/security/2015/dsa-3183 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4079
https://notcve.org/view.php?id=CVE-2008-4079
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) 4.x hasta 4.20, y 3.36 y versiones anteriores; Movable Type Enterprise 4.x hasta 4.20, y 1.54 y versiones anteriores; y Movable Type Community Solution permite a atacantes remotos inyectar web script o HTML a través de vectores no especificados. • http://jvn.jp/en/jp/JVN30385652/index.html http://www.securityfocus.com/bid/31073 http://www.sixapart.jp/movabletype/news/2008/08/07-1445.html http://www.sixapart.jp/movabletype/news/2008/08/28-1500.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2006-5080
https://notcve.org/view.php?id=CVE-2006-5080
Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función de búsqueda en Six Apart Movable Type 3.3 a 3.32, y Movable Type Enterprise 1.01 y 1.02, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://jvn.jp/jp/JVN%2368295640/index.html http://secunia.com/advisories/22109 http://www.osvdb.org/29177 http://www.securityfocus.com/bid/20228 http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html http://www.vupen.com/english/advisories/2006/3779 https://exchange.xforce.ibmcloud.com/vulnerabilities/29183 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •