CVSS: 7.5EPSS: 1%CPEs: 87EXPL: 0CVE-2012-0320
https://notcve.org/view.php?id=CVE-2012-0320
Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script. Movable Type anteriores a 4.38, 5.0x anteriores a 5.07, y 5.1x anteriores a 5.13 permite a atacantes remotos controlar las sesiones a través de vectores sin especificar relacionados con (1) la característica "commenting" (2) y "community script". • http://jvn.jp/en/jp/JVN20083397/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000018 http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html http://www.securityfocus.com/bid/52138 http://www.securitytracker.com/id?1026738 •
CVSS: 6.8EPSS: 0%CPEs: 87EXPL: 0CVE-2012-0317
https://notcve.org/view.php?id=CVE-2012-0317
Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Movable Type anteriores 4.38, 5.0x anteriores 5.07, y 5.1x anteriores 5.13. Permiten a usuarios remotos secuestrar (hijack) la autenticación de usuarios aleatorios a través de las peticiones que modifican datos de (1) la opción de comentarios ("commenting feature") o (2) "community script". • http://jvn.jp/en/jp/JVN70683217/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2012-000015 http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html http://www.securityfocus.com/bid/52138 http://www.securitytracker.com/id?1026738 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2007-6751
https://notcve.org/view.php?id=CVE-2007-6751
Cross-site scripting (XSS) vulnerability in the MailForm plugin before 1.20 for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilida de ejecución de secuencias de comandos en sitios cruzados (XSS) en el complemento MailForm antes de v1.20 para Movable Type, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://jvn.jp/en/jp/JVN60887968/index.html http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000108.html http://www.h-fj.com/blog/archives/2007/01/23-111038.php https://exchange.xforce.ibmcloud.com/vulnerabilities/72344 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2010-1985
https://notcve.org/view.php?id=CVE-2010-1985
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in Six Apart Movable Type 5.0 and 5.01 allow remote attackers to inject arbitrary web script or HTML via unknown vectors. Multiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la interfaz de usuario administrativa en Six Apart Movable Type v5.0 y v5.01 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores desconocidos. • http://jvn.jp/en/jp/JVN92854093/index.html http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000017.html http://secunia.com/advisories/39741 http://www.movabletype.com/blog/2010/05/movable-type-502.html http://www.movabletype.org/documentation/appendices/release-notes/movable-type-502.html http://www.vupen.com/english/advisories/2010/1136 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 60EXPL: 0CVE-2009-2492
https://notcve.org/view.php?id=CVE-2009-2492
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en mt-wizard.cgi en Six Apart Movable Type anteriores a v4.261, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no específicos, es una vulnerabilidad distinta a CVE-2009-2480. • http://jvn.jp/en/jp/JVN86472161/index.html http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000042.html http://secunia.com/advisories/35534 http://www.securityfocus.com/bid/35885 http://www.vupen.com/english/advisories/2009/1668 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •