CVE-2007-0231

Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...

Cross site scripting

Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...

CVE-2007-0231

Cross-site scripting XSS vulnerability in Movable Type MT 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Comments field...

CVE-2007-0231

CVE-2007-0231 describes a cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33 where, if nofollow is disabled and unmoderated comments are enabled, a remote attacker can inject arbitrary web script or HTML via the Comments field. The vulnerability concerns Movable Type 3.33 and is t...

[SA23669] Movable Type "nofollow" Plugin Comment Script Insertion

TITLE: Movable Type "nofollow" Plugin Comment Script Insertion SECUNIA ADVISORY ID: SA23669 VERIFY ADVISORY: http://secunia.com/advisories/23669/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Movable Type 3.x http://secunia.com/product/5753/ DESCRIPTION: A...

CVE-2006-5080

Cross-site scripting XSS vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-5080

CVE-2006-5080 is a cross-site scripting (XSS) vulnerability in Six Apart Movable Type up to version 3.32 (Movable Type 3.3–3.32) and Movable Type Enterprise up to 1.02, triggered through the search function. The underlying issue allows an attacker to inject arbitrary HTML/JavaScript via unspecifi...

CVE-2006-5080

Cross-site scripting XSS vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

JVN#68295640 Movable Type vulnerabile to cross-site scripting

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected Movable Type 3.3, 3.31, 3.32 Movable Type Enterprise 1.01, 1.02 For more information, refer to the...

MT -- Search Unspecified XSS

Secunia reports: Arai has reported a vulnerability in Movable Type and Movable Type Enterprise, which can be exploited by malicious people to conduct cross-site scripting attacks. Some unspecified input passed via the search functionality isn't properly sanitised before being returned to the user...

JVN#10222000 QUICK CART OS command injection vulnerability

Impact A remote attacker could execute arbitrary operating system commands on a server running QUICK CART. Solution Products Affected QUICK CART Ver 1 QUICK CART Ver 2 QUICK CART Free QUICK CART Pro QUICK CART Plugin for Movable Type 3.2...

JVN#68630618 QUICK CART cross-site scripting vulnerability

Impact An arbitrary script could be executed on the user's web browser. Solution Products Affected QUICK CART Ver 1 QUICK CART Ver 2 QUICK CART Free QUICK CART Pro QUICK CART Plugin for Movable Type 3.2...

CVE-2005-4690

Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types such as HTML and image files by selecting an arbitrary directory as a blog's top-level directory. NOTE: this issue can be used in conjunction with CVE-2005-3102 to...

CVE-2005-4689

Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie...

CVE-2005-4689

CVE-2005-4689 concerns Six Apart Movable Type 3.16, where account names and password hashes are stored in a cookie. The underlying vulnerability is credential exposure via the cookie, enabling a remote attacker to log in to an account by sniffing that cookie. The connected documents confirm the a...

CVE-2005-4690

CVE-2005-4690 relates to Six Apart Movable Type 3.16, where local users with blog-creation privileges can create or overwrite arbitrary files (e.g., HTML and image files) by selecting an arbitrary directory as the blog’s top-level directory. Note that this issue can be exploited in conjunction wi...

CVE-2005-4689

Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie...

CVE-2005-4690

Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types such as HTML and image files by selecting an arbitrary directory as a blog's top-level directory. NOTE: this issue can be used in conjunction with CVE-2005-3102 to...

Xss в Movable Type

Продукт:Movable Type Версия:3.2b3 Опасность:Низкая Тип уязвимости:Межсайтовый скриптинг Описание:Недостаточная фильтрация входящих параметров. Пример:www.target.com/cgi-bin/mt/mt.cgi?mode=view&type=entry&id=1223E3Cscript3Ealert3C/script3E&blogid=1...

[Full-disclosure] Buggy blogging

Portcullis Security Advisory Tim Brown [email protected] - www.portcullis-security.com [email protected] - www.nth-dimension.org.uk Vulnerable System: Movable Type Vulnerability Title: Username and password hash for administration interface stored in cookie. Vulnerability...