Chapter H: Changelog
3.33 (2006.09.26)
Show
Release notes - Movable Type 3.33
39376: MT::App XSS vulnerablity on '__mode' parameter
FIXED: Fixed an XSS vulnerability in MT::App which allowed an attacker to include malicious Javascript in the __mode parameter value of a URL.
39121: MT-Search `IncludeBlogs` XSS vulnerability
FIXED: Fixed an XSS vulnerability in mt-search.cgi which allowed an attacker to include malicious Javascript in the IncludeBlogs parameter value.
39381: Activity log search query metadata XSS vulnerability
FIXED: Fixed an XSS vulnerability in mt-search.cgi in which malicious script data from searches would be displayed and executed in the Activity Log.
39488: Sanitization of activity log metadata
FIXED: Implemented protection from previous XSS attacks against the MT activity log by retroactively sanitizing log metadata.
38666: Comment preview XSS vulnerability
FIXED: Fixed an XSS vulnerability in mt-comments.cgi in which malicious script content was not properly sanitized in comment preview.
39460: MT Newsbox/NewsboxURL source XSS vulnerability
FIXED: Implemented sanitization of content from the MT Newsbox (or customized NewsboxURL) to prevent XSS attacks injected into the NewsboxURL source.
39439: Feeds.app Lite XSS vulnerability with unsanitized feeds
FIXED: Fixed an XSS vulnerability in Feeds.app Lite in which malicious script data was not properly sanitized in incoming feed subscriptions.
