Most recent entries from all

EUVD-2026-232984

fkie_cve-2022-43660

Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.

GHSA-j8hc-rq6g-3f96

gsd-2022-43660

jvndb-2022-000090

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below. * Improper Validation of Syntactic Correctness of Input (CWE-1286) - CVE-2022-45113 * Cross-site Scripting (CWE-79) - CVE-2022-45122 * Improper Neutralization of Server-Side Includes (SSI) Within a Web Page (CWE-97) - CVE-2022-4366 CVE-2022-45113, CVE-2022-45122 SHIGA TAKUMA of BroadBand Security, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2022-43660 Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the Information Security Early Warning Partnership.