Sql injection

The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the A-Form PC and PC/Mobile before 3.1 plug-ins for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-2676...

CVE-2011-4274

Cross-site scripting XSS vulnerability in the A-Form PC and PC/Mobile before 3.1 plug-ins for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-2676...

CVE-2011-4274

CVE-2011-4274 is a Cross-site scripting (XSS) vulnerability in the A-Form PC and PC/Mobile plug-ins for Movable Type, affecting versions before 3.1. The root cause is not fully specified in the provided description, but the issue is located in Movable Type’s A-Form plug-ins and enables remote scr...

CVE-2011-2676

The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors...

CVE-2011-2676

The CVE-2011-2676 issue concerns the A-Form family of Movable Type plug-ins (A-Form bamboo <1.3.6 and 2.x <2.0.3; A-Form PC/PC-Mobile

Multiple SKYARC System Co., Ltd. products vulnerable to cross-site request forgery

Overview Multiple products provided by SKYARC System Co., Ltd. contain a cross-site request forgery vulnerability. MTCMS and multiple Movable Type plugins provided by SKYARC System Co., Ltd. contain a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged...

Multiple SKYARC System Co., Ltd. products fail to restrict access permissions

Overview Multiple products provided by SKYARC System Co., Ltd. contain an issue where access permissions are not restricted. MTCMS and multiple Movable Type plugins provided by SKYARC System Co., Ltd. contain an issue where access permissions are not restricted. Impact A user without the...

JVN#41032068: Multiple SKYARC System Co., Ltd. products fail to restrict access permissions

MTCMS and multiple Movable Type plugins provided by SKYARC System Co., Ltd. contain an issue where access permissions are not restricted. Impact A user without the appropriate privileges may alter settings and files. Solution Apply an update Update to the latest version according to the informati...

JVN#56667137: Multiple SKYARC System Co., Ltd. products vulnerable to cross-site request forgery

MTCMS and multiple Movable Type plugins provided by SKYARC System Co., Ltd. contain a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged into MTCMS or a Movable Type implementation with any of the plugins from "Products Affected" running, information...

A-Form vulnerable in restricting access

Overview A-Form contains a vulnerability in restricting access permissions. A-Form is a plug-in for Movable Type that adds mail forms and survey forms. A-Form contains a vulnerability in restricting access permissions. Impact Information managed by A-Form may be altered by a user who does not hav...

JVN#34980730: A-Form vulnerable in restricting access

A-Form is a plug-in for Movable Type that adds mail forms and survey forms. A-Form contains a vulnerability in restricting access permissions. Impact Information managed by A-Form may be altered by a user who does not have administrative privileges. Solution Update the Software Update to the late...

Debian Security Advisory DSA 2263-1 (movabletype-opensource)

The remote host is missing an update to movabletype-opensource announced via advisory DSA 2263-1. OpenVAS Vulnerability Test $Id: deb22631.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2263-1 movabletype-opensource Authors: Thomas Reinke Copyright:...

Movable Type User Registration Restriction Bypass

The version of Movable Type running on the remote host has a restriction bypass vulnerability. It is possible to create new user accounts even when registration has been disabled in the blog configuration. A remote attacker could exploit this to register new accounts for blogs that do not allow...

[SECURITY] [DSA 2263-1] movabletype-opensource security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2263-1 [email protected] http://www.debian.org/security/ Florian Weimer June 16, 2011 http://www.debian.org/security/faq -...

Debian DSA-2263-2 : movabletype-opensource - several vulnerabilities

It was discovered that Movable Type, a weblog publishing system, contains several security vulnerabilities : A remote attacker could execute arbitrary code in a logged-in users' web browser. A remote attacker could read or modify the contents in the system under certain circumstances. %NASLMINLEV...

DSA-2263-1 movabletype-opensource - several

Bulletin has no description...

Movable Type < 4.361 / 5.051 / 5.11 Multiple Unspecified Vulnerabilities

Binary data 5952.prm...

Movable Type mt-comments.cgi static Parameter XSS

The version of Movable Type running on the remote host is affected by a cross-site scripting vulnerability because the application fails to properly sanitize input to the 'static' parameter of the 'mt-comments.cgi' script. An attacker may be able to leverage this to inject arbitrary HTML and scri...

Movable Type vulnerable to cross-site scripting

Overview Movable Type contains a cross-site scripting vulnerability. Movable Type, a web log system from Six Apart KK, contains a cross-site scripting vulnerability due to an issue in the management screen. This vulnerability is different than the previous vulnerabilities disclosed on JVN. Takesh...