CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5845
https://notcve.org/view.php?id=CVE-2008-5845
Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Six Apart Movable Type (MT) anterior a v4.23 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, o (4) el campo MTCommenterName en una plantilla Profile View; un (5) listado de pantalla o (6) pantalla de edición en el CMS app; (7) un título TrackBack, relacionado con la librería HTML sanitization; o (8) un archivo de nombre de usuario (también llamado archive title) en una plantilla publicada Community Blog. • http://jvn.jp/en/jp/JVN45658190/index.html http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html http://www.movabletype.org/mt_423_change_log.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5846
https://notcve.org/view.php?id=CVE-2008-5846
Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish posts via a "system-wide entry listing screen." Six Apart Movable Type (MT) anterior a v4.23 permite a usuarios remotos autenticados con permiso para crear entradas destinadas a evitar las restricciones de acceso y publicación de entradas a través de un "system-wide entry listing screen". • http://www.movabletype.org/mt_423_change_log.html http://www.securityfocus.com/bid/33133 https://exchange.xforce.ibmcloud.com/vulnerabilities/47759 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2008-5808
https://notcve.org/view.php?id=CVE-2008-5808
Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type, Movable Type Open Source (MTOS), and Movable Type Enterprise 4.x before 4.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to "application management." Vulnerabilidad de Secuencias de comandos en Sitios Cruzados (XSS) en Six Apart Movable Type Enterprise (MTE) v1.x anteriores a v1.56; Movable Type (MT) v3.x anteriores a v3.38; y Movable Type, Movable Type Open Source (MTOS), y Movable Type Enterprise v4.x anteriores a v4.23, permite a atacantes remotos inyectar secuencias de comandos Web o HTML a través de vectores no especificados, posiblemente esté relacionado con "gestión de la aplicación". • http://jvn.jp/en/jp/JVN02216739/index.html http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000067.html http://secunia.com/advisories/32935 http://www.movabletype.jp/blog/_movable_type_423.html http://www.securityfocus.com/bid/32604 https://exchange.xforce.ibmcloud.com/vulnerabilities/47019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-4634
https://notcve.org/view.php?id=CVE-2008-4634
Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the administrative page, a different vulnerability than CVE-2008-4079. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type v4 hasta v4.21 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados relacionados con una página administrativa, siendo una vulnerabilidad diferente a CVE-2008-4079. • http://jvn.jp/en/jp/JVN81490697/index.html http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000072.html http://secunia.com/advisories/32305 http://www.securityfocus.com/bid/31826 http://www.sixapart.jp/movabletype/news/2008/10/15-1400.html https://exchange.xforce.ibmcloud.com/vulnerabilities/45968 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4079
https://notcve.org/view.php?id=CVE-2008-4079
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) 4.x hasta 4.20, y 3.36 y versiones anteriores; Movable Type Enterprise 4.x hasta 4.20, y 1.54 y versiones anteriores; y Movable Type Community Solution permite a atacantes remotos inyectar web script o HTML a través de vectores no especificados. • http://jvn.jp/en/jp/JVN30385652/index.html http://www.securityfocus.com/bid/31073 http://www.sixapart.jp/movabletype/news/2008/08/07-1445.html http://www.sixapart.jp/movabletype/news/2008/08/28-1500.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •