CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3342
https://notcve.org/view.php?id=CVE-2007-3342
Multiple cross-site scripting (XSS) vulnerabilities in Movable Type (MT) before 3.34 allow remote attackers to inject arbitrary web script or HTML via comments that have (1) a malformed SGML numeric character reference with a '\0' (0x00) character in a javascript: URI or (2) an attribute in an element that lacks the '>' character at the end of the start tag, a different vulnerability than CVE-2007-0231. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el Movable Type (MT) anterior al 3.34, permite a atacantes remotos la inyección de secuencias de comandos web o HTML de su elección a través de comentarios que tienen (1) una referencia a un caracter numérico SGML mal formado con un caracter '\0' (0x00) en un javascript: URI o (2) un atributo en un elemento que carece del caracter '>' al final de la etiqueta de comienzo, vulnerabilidad diferente a la CVE-2007-0231. • http://osvdb.org/38621 http://securityreason.com/securityalert/2821 http://www.securityfocus.com/archive/1/458196/100/0/threaded http://www.sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0604
https://notcve.org/view.php?id=CVE-2007-0604
Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the MTCommentPreviewIsStatic tag, which can open the "comment entry screen," a different vulnerability than CVE-2007-0231. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) anterior a 3.34 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados relacionados con la etiqueta MTCommentPreviewIsStatic, lo cual abre la "pantalla de entrada de comentarios", una vulnerabilidad diferente que CVE-2007-0231. • http://osvdb.org/32987 http://www.sixapart.com/movabletype/beta/distros/MT-3.34-beta-Release-Notes.html •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2007-0231
https://notcve.org/view.php?id=CVE-2007-0231
Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Movable Type (MT) 3.33, cuando nofollow está desactivado y comentarios sin moderación activado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo Comments. • http://golem.ph.utexas.edu/~distler/blog/archives/001102.html http://osvdb.org/32717 http://secunia.com/advisories/23669 http://www.vupen.com/english/advisories/2007/0142 http://www.zackvision.com/weblog/2007/01/movabletype-security-bug.html •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2006-5080
https://notcve.org/view.php?id=CVE-2006-5080
Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función de búsqueda en Six Apart Movable Type 3.3 a 3.32, y Movable Type Enterprise 1.01 y 1.02, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://jvn.jp/jp/JVN%2368295640/index.html http://secunia.com/advisories/22109 http://www.osvdb.org/29177 http://www.securityfocus.com/bid/20228 http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html http://www.vupen.com/english/advisories/2006/3779 https://exchange.xforce.ibmcloud.com/vulnerabilities/29183 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4689
https://notcve.org/view.php?id=CVE-2005-4689
Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie. • http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html http://www.sixapart.com/movabletype/docs/3.2/h_changelog/3_2.html •