729 matches found
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9130
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The website name wasn't properly escaped when displayed in the campaign-zone.php script...
CVE-2016-9457
Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, periodstart, periodend, and possibly others...
CVE-2016-9470
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...
CVE-2016-9126
Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...
CVE-2016-9130
CVE-2016-9130 concerns Revive Adserver prior to 3.2.3, which is vulnerable to a Persistent XSS via the user interface due to improper escaping of the website name in campaign-zone.php. The underlying issue is a failure to escape displayed data, allowing a trusted (non-admin) attacker to inject sc...
CVE-2016-9130
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The website name wasn't properly escaped when displayed in the campaign-zone.php script...
CVE-2016-9457
Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, periodstart, periodend, and possibly others...
CVE-2016-9471
Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...
CVE-2016-9128
CVE-2016-9128 affects Revive Adserver prior to 3.2.3. A reflected XSS flaw exists in the affiliate-preview.php script in www/admin, enabling an attacker to steal the session ID of an authenticated user by convincing them to visit a crafted URL. Affected component: Revive Adserver web admin. Root ...
CVE-2016-9124
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users...
CVE-2016-9128
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...
CVE-2016-9472
Revive Adserver contains a Reflected XSS in installer UI affecting versions before 3.2.5 and 4.0.0. The vulnerability is caused by reflected input in the web installer scripts, exposed via parameters such as dbHost and dbUser (and possibly others). Impact per the CVE entry is a limited window for...
CVE-2016-9125
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to ste...
CVE-2016-9456
CVE-2016-9456 affects Revive Adserver prior to 3.2.3, which suffers CSRF in admin interface scripts. The Revive Adserver team audited the admin scripts and fixed 20+ CSRF-related issues. Upgrade to 3.2.3 or later to mitigate. Exploitation details are not provided in the connected documents.
CVE-2016-9129
Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such...
CVE-2016-9456
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed...
CVE-2016-9127
Revive Adserver prior to 3.2.3 is affected by a CSRF vulnerability in the password recovery form, enabling an attacker to trigger mass password recovery emails to registered users. The issue, together with a related bug that could send recovery emails to all users, has been fixed in version 3.2.3...
CVE-2016-9470
Revive Adserver is affected by a Reflected File Download (RFD) vulnerability in the file www/delivery/asyncspc.php, impacting versions before 3.2.5 and 4.0.0. The issue allows an attacker to cause a victim’s machine to download a file from a trusted domain, potentially gaining control of the vict...
CVE-2016-9124
Revive Adserver prior to 3.2.3 is affected by improper restriction of excessive authentication attempts on the login page, enabling password-guessing attacks. The issue stems from login controls that do not adequately throttle/brute-force limit, though a random delay and anti-parallel brute-forci...