931 matches found
CVE-2020-8142
CVE-2020-8142 affects Revive Adserver
CVE-2020-8142
A security restriction bypass vulnerability has been discovered in Revive Adserver version 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was howev...
CVE-2020-8143: URL Redirection to Untrusted Site
An Open Redirect vulnerability was discovered in Revive Adserver version 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/-modify.php...
PT-2020-19979
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.0.5 Description A remote attacker could trick logged-in users into opening a specifically crafted link, redirecting them to any destination. The CSRF protection of the "/www/admin/-modify.php" endpoint could...
CVE-2020-8142: Incorrect Authorization
A security restriction bypass vulnerability has been discovered in Revive Adserver version 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was howev...
PT-2020-19978
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.0.5 Description A security restriction bypass issue has been found, allowing an attacker with access to the admin user interface to change the email address or password of the currently logged-in user withou...
Revive Adserver: Cross Site Scripting and Open Redirect in affiliate-preview.php file
Summary: Stored XSS can be submitted on the Website using Default Manager, and anyone who will check the report the XSS and Open Redirect will trigger. Description: Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injecte...
Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-10427)
Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. The vulnerability stems from the lack of prope...
Revive Adserver: Open redirection bypass in /www/admin/campaign-modify.php
Description - There is an open redirect on /www/admin/campaign-modify.php?returnurl= F713773 - By using //// at the start of the link, you can bypass the open redirect filter. - example: /www/admin/campaign-modify.php?clientid=&campaignid=&returnurl=%2F%2F%2F%2Fhackerone.com Impact This...
Revive Adserver: bypass old password with array in /admin/account-user-email.php
Short Description - attacker maybe change email or password without enter old password with array param. - version:revive-adserver-5.0.4 - os :window POC F712486 Impact attacker maybe change email or password without enter old password...
CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
Cross site scripting
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
CVE-2020-8115
Revive Adserver
CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
CVE-2020-8115
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
CVE-2020-8115: Improper Neutralization of Input During Web Page Generation
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...
PT-2020-19953
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.0.4 Description A reflected XSS issue has been found in the afr.php delivery script. This issue allows an attacker to execute arbitrary JS code on the victim's browser by sending a query string to the...
Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-23477)
Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. An attacker can exploit the vulnerability to...