CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 0CVE-2011-5085
https://notcve.org/view.php?id=CVE-2011-5085
Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors. Vulnerabilidad no específica en Movable Type v4.x anteriores a v4.36 y v5.x anteriores a v5.05 permite a atacantes remotos leer y modificar datos a través de vectores no determinados. • http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html •
CVSS: 7.5EPSS: 1%CPEs: 87EXPL: 0CVE-2012-0320
https://notcve.org/view.php?id=CVE-2012-0320
Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script. Movable Type anteriores a 4.38, 5.0x anteriores a 5.07, y 5.1x anteriores a 5.13 permite a atacantes remotos controlar las sesiones a través de vectores sin especificar relacionados con (1) la característica "commenting" (2) y "community script". • http://jvn.jp/en/jp/JVN20083397/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000018 http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html http://www.securityfocus.com/bid/52138 http://www.securitytracker.com/id?1026738 •
CVSS: 6.8EPSS: 0%CPEs: 87EXPL: 0CVE-2012-0317
https://notcve.org/view.php?id=CVE-2012-0317
Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Movable Type anteriores 4.38, 5.0x anteriores 5.07, y 5.1x anteriores 5.13. Permiten a usuarios remotos secuestrar (hijack) la autenticación de usuarios aleatorios a través de las peticiones que modifican datos de (1) la opción de comentarios ("commenting feature") o (2) "community script". • http://jvn.jp/en/jp/JVN70683217/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000015 http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html http://www.securityfocus.com/bid/52138 http://www.securitytracker.com/id?1026738 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.8EPSS: 0%CPEs: 57EXPL: 0CVE-2009-2481
https://notcve.org/view.php?id=CVE-2009-2481
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors. El archivo mt-wizard.cgi en Movable Type de Six Apart anterior a versión 4.261, cuando las plantillas globales no se inicializan, permite a los atacantes remotos omitir las restricciones de acceso y (1) enviar correo electrónico a direcciones arbitrarias o (2) obtener información confidencial por medio de vectores no especificados. • http://jvn.jp/en/jp/JVN08369659/index.html http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000043.html http://secunia.com/advisories/35534 http://www.securityfocus.com/bid/35471 http://www.vupen.com/english/advisories/2009/1668 https://exchange.xforce.ibmcloud.com/vulnerabilities/51330 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4079
https://notcve.org/view.php?id=CVE-2008-4079
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) 4.x hasta 4.20, y 3.36 y versiones anteriores; Movable Type Enterprise 4.x hasta 4.20, y 1.54 y versiones anteriores; y Movable Type Community Solution permite a atacantes remotos inyectar web script o HTML a través de vectores no especificados. • http://jvn.jp/en/jp/JVN30385652/index.html http://www.securityfocus.com/bid/31073 http://www.sixapart.jp/movabletype/news/2008/08/07-1445.html http://www.sixapart.jp/movabletype/news/2008/08/28-1500.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •