CVE-2013-0209

Movable Type is affected by CVE-2013-0209 through mt-upgrade.cgi (lib/MT/Upgrade.pm) in versions 4.2x and 4.3x up to 4.38. The vulnerability arises because database-migration functions do not require authentication, enabling an attacker to perform eval and SQL injection via crafted parameters, in...

CVE-2013-0209: Improper Authentication

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injecti...

Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution

This module can be used to execute a payload on MoveableType MT that exposes a CGI script, mt-upgrade.cgi usually at /mt/mt-upgrade.cgi, that is used during installation and updating of the platform. The vulnerability arises due to the following properties: 1. This script may be invoked remotely...

Movable Type Pro 5.13en - Persistent Cross-Site Scripting

Movable Type Pro 5.13en - Persistent Cross-Site Scripting -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive,...

Movable Type Pro 5.13en - Persistent Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive, Full Disclosure Introduction Movable Type MT started as on...

Movable Type Pro 5.13en Cross Site Scripting

Our researchers discovered a persistent XSS vulnerability, allowing an attacker to inject arbitrary script code into the comment section of any existing Mt5.13en installation. Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Ty...

Movable Type Pro 5.13en Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive, Full Disclosure Introduction Movable Type MT started as on...

CVE-2012-2642

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644...

CVE-2012-2644

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642...

Cross site scripting

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644...

Cross site scripting

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642...

CVE-2012-2644

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642...

CVE-2012-2644

Technical details about CVE-2012-2644 (affected product, vector, impact, and remediation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2012-2642

CVE-2012-2642 affects the MT4i plugin for Movable Type (version 3.1 beta 4 and earlier). It is an XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The CVSS v2 base score is 4.3 (Medium) with network access, medium attack complexity, no...

CVE-2012-2642

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644...

CVE-2012-2642: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644...

CVE-2012-2644: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642...

Movable Type plugin MT4i vulnerable to cross-site scripting

Overview MT4i contains a cross-site scripting vulnerability. MT4i is a Movable Type plugin. MT4i contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN80835745. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Movable Type plugin MT4i vulnerable to cross-site scripting

Overview MT4i contains a cross-site scripting vulnerability. MT4i is a Movable Type plugin. MT4i contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN79111101. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the...

JVN#79111101: Movable Type plugin MT4i vulnerable to cross-site scripting

MT4i is a Movable Type plugin. MT4i contains a cross-site scripting vulnerability. Note that this vulnerability is different from JVN80835745. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the informati...