Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2726▼ 82 respecto a la semana anterior

Críticas / altas1416▲ 189 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)100▼ 400 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2016-5742	Modificada	Crítica (9.8)	1.6%	—	Sixapart Movable Type Sixapart Movable Type Open Source	23/1/2017	17/6/2026	SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1497	Modificada	Media (4)	1.8%	—	Movabletype Movable Type Open Source Movabletype Movable Type Enterprise Movabletype Movable Type Advanced Movabletype Movable Type PRO	3/3/2012	16/6/2026	The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.
CVE-2012-1262	Modificada	Media (4.3)	1.9%	—	Movabletype Movable Type Open Source Movabletype Movable Type Enterprise Movabletype Movable Type Advanced Movabletype Movable Type PRO	3/3/2012	16/6/2026	Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
CVE-2012-0319	Modificada	Media (6.5)	2.4%	—	Movabletype Movable Type Open Source Movabletype Movable Type Enterprise Movabletype Movable Type Advanced Movabletype Movable Type PRO	3/3/2012	16/6/2026	The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue.
CVE-2012-0318	Modificada	Media (4.3)	1.3%	—	Movabletype Movable Type Open Source Movabletype Movable Type Enterprise Movabletype Movable Type Advanced Movabletype Movable Type PRO	3/3/2012	16/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262.