CVE-2012-2644 | | | 2012-07-07 | Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or H… |
CVE-2012-2642 | | | 2012-07-07 | Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or H… |
CVE-2011-2676 | | | 2011-11-03 | The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative… |
CVE-2009-2492 | | | 2009-07-17 | Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2009-2481 | | | 2009-07-16 | mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1)… |
CVE-2008-5808 | | | 2009-01-02 | Cross-site scripting (XSS) vulnerability in Six Apart Movable Type Enterprise (MTE) 1.x before 1.56; Movable Type (MT) 3.x before 3.38; and Movable Type, Movab… |
CVE-2008-4634 | | | 2008-10-21 | Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via unknown vectors rela… |
CVE-2008-4079 | | | 2008-09-15 | Cross-site scripting (XSS) vulnerability in Movable Type (MT) 4.x through 4.20, and 3.36 and earlier; Movable Type Enterprise 4.x through 4.20, and 1.54 and ea… |
CVE-2007-3342 | | | 2007-06-21 | Multiple cross-site scripting (XSS) vulnerabilities in Movable Type (MT) before 3.34 allow remote attackers to inject arbitrary web script or HTML via comments… |
CVE-2007-0231 | | | 2007-01-13 | Cross-site scripting (XSS) vulnerability in Movable Type (MT) 3.33, when nofollow is disabled and unmoderated comments are enabled, allows remote attackers to… |
CVE-2006-5080 | | | 2006-09-29 | Cross-site scripting (XSS) vulnerability in the search function in Six Apart Movable Type 3.3 to 3.32, and Movable Type Enterprise 1.01 and 1.02, allows remote… |
CVE-2005-4690 | | | 2005-12-31 | Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types (such as HTML and image fi… |
CVE-2005-4689 | | | 2005-12-31 | Six Apart Movable Type 3.16 stores account names and password hashes in a cookie, which allows remote attackers to login to an account by sniffing the cookie. |
CVE-2005-3104 | | | 2005-09-28 | mt-comments.cgi in Movable Type before 3.2 allows attackers to redirect users to other web sites via URLs in comments. |
CVE-2005-3103 | | | 2005-09-28 | Cross-site scripting (XSS) vulnerability in Movable Type before 3.2 allows remote attackers to inject arbitrary web script or HTML via the (1) title, (2) categ… |
CVE-2005-3102 | | | 2005-09-28 | The administrative interface in Movable Type allows attackers to upload files with arbitrary extensions under the web root. |
CVE-2005-3101 | | | 2005-09-28 | The password reset feature in Movable Type before 3.2 generates different error messages depending on whether a user exists or not, which allows remote attacke… |
CVE-2003-0287 | | | 2003-06-16 | Cross-site scripting (XSS) vulnerability in Movable Type before 2.6, and possibly other versions including 2.63, allows remote attackers to insert arbitrary we… |