CVSS: 10.0EPSS: 0%CPEs: 16EXPL: 0CVE-2009-0752
https://notcve.org/view.php?id=CVE-2009-0752
Unspecified vulnerability in Movable Type Pro and Community Solution 4.x before 4.24 has unknown impact and attack vectors, possibly related to the password recovery mechanism. Vulnerabilidad sin especificar en Movable Type Pro y Community Solution v4.x anteriores a v4.24 cuyo impacto y vectores de ataque se desconocen, pero que, posiblemente, estén relacionados con el mecanismo de recuperación de contraseñas. • http://www.movabletype.com/blog/2009/02/movable-type-424-get-updated-with-better-password-recovery.html •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5845
https://notcve.org/view.php?id=CVE-2008-5845
Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary web script or HTML via a (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, or (4) MTCommenterName field in a Profile View template; a (5) listing screen or (6) edit screen in the CMS app; (7) a TrackBack title, related to the HTML sanitization library; or (8) a user archive name (aka archive title) on a published Community Blog template. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Six Apart Movable Type (MT) anterior a v4.23 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante (1) MTEntryAuthorUsername, (2) MTAuthorDisplayName, (3) MTEntryAuthorDisplayName, o (4) el campo MTCommenterName en una plantilla Profile View; un (5) listado de pantalla o (6) pantalla de edición en el CMS app; (7) un título TrackBack, relacionado con la librería HTML sanitization; o (8) un archivo de nombre de usuario (también llamado archive title) en una plantilla publicada Community Blog. • http://jvn.jp/en/jp/JVN45658190/index.html http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000031.html http://www.movabletype.org/mt_423_change_log.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 17EXPL: 0CVE-2008-5846
https://notcve.org/view.php?id=CVE-2008-5846
Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish posts via a "system-wide entry listing screen." Six Apart Movable Type (MT) anterior a v4.23 permite a usuarios remotos autenticados con permiso para crear entradas destinadas a evitar las restricciones de acceso y publicación de entradas a través de un "system-wide entry listing screen". • http://www.movabletype.org/mt_423_change_log.html http://www.securityfocus.com/bid/33133 https://exchange.xforce.ibmcloud.com/vulnerabilities/47759 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4079
https://notcve.org/view.php?id=CVE-2008-4079
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and earlier; and Movable Type Community Solution allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) 4.x hasta 4.20, y 3.36 y versiones anteriores; Movable Type Enterprise 4.x hasta 4.20, y 1.54 y versiones anteriores; y Movable Type Community Solution permite a atacantes remotos inyectar web script o HTML a través de vectores no especificados. • http://jvn.jp/en/jp/JVN30385652/index.html http://www.securityfocus.com/bid/31073 http://www.sixapart.jp/movabletype/news/2008/08/07-1445.html http://www.sixapart.jp/movabletype/news/2008/08/28-1500.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2006-5080
https://notcve.org/view.php?id=CVE-2006-5080
Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función de búsqueda en Six Apart Movable Type 3.3 a 3.32, y Movable Type Enterprise 1.01 y 1.02, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://jvn.jp/jp/JVN%2368295640/index.html http://secunia.com/advisories/22109 http://www.osvdb.org/29177 http://www.securityfocus.com/bid/20228 http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html http://www.vupen.com/english/advisories/2006/3779 https://exchange.xforce.ibmcloud.com/vulnerabilities/29183 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •