GCVE - cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sixapart:movable_type:4.21:*:*:*:*:*:*:*

part: a version: 4.21 update: *

Vendor	Sixapart (`543b49bd-f8e0-5cde-b451-64c37d476b91`)
Product	Movable Type (`0b1b8903-7eaa-5490-a1bc-f063c17195fc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-0209`	vulnerable	2026-06-08 05:03:45.836081	Details available lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code. Published: 2013-01-23T01:00:00.000Z Updated: 2024-09-16T23:35:35.688Z Open on db.gcve.eu Reference links http://www.sec-1.com/blog/?p=402 http://www.movabletype.org/2013/01/movable_type_438_patch.html http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt http://openwall.com/lists/oss-security/2013/01/22/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-5085`	vulnerable	2026-06-08 04:59:34.538100	Details available Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors. Published: 2012-04-02T18:00:00.000Z Updated: 2024-08-07T00:23:40.017Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-5084`	vulnerable	2026-06-08 04:59:34.522720	Details available Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2012-04-02T18:00:00.000Z Updated: 2024-08-07T00:23:40.109Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2423 http://www.movabletype.org/2011/05/movable_type_51_and_505_436_security_update.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2492`	vulnerable	2026-06-08 04:51:28.921190	Details available Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480. Published: 2009-07-17T16:00:00.000Z Updated: 2024-08-07T05:52:14.767Z Open on db.gcve.eu Reference links http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000042.html http://www.securityfocus.com/bid/35885 http://jvn.jp/en/jp/JVN86472161/index.html http://secunia.com/advisories/35534 http://www.vupen.com/english/advisories/2009/1668	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2481`	vulnerable	2026-06-08 04:51:28.834991	Details available mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors. Published: 2009-07-16T16:00:00.000Z Updated: 2024-08-07T05:52:14.744Z Open on db.gcve.eu Reference links http://jvn.jp/en/jp/JVN08369659/index.html http://secunia.com/advisories/35534 http://www.vupen.com/english/advisories/2009/1668 http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000043.html http://www.securityfocus.com/bid/35471	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.