CVE-2016-9126

Affected software: Revive Adserver prior to 3.2.3. Issue: persistent XSS in the audit trail widget on login due to inadequate escaping of usernames; an authenticated user who can create other users could leverage this to access the administrator account. Impact (per sources): CVSS metrics show ba...

CVE-2016-9129

CVE-2016-9129 affects Revive Adserver before 3.2.3. The issue is an information disclosure vulnerability where an attacker can determine whether an email address is associated with one or more user accounts by inspecting the password recovery message. This leaks partial confidentiality but cannot...

CVE-2016-9472

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narr...

CVE-2016-9125

The CVE-2016-9125 entry concerns Revive Adserver prior to version 3.2.3, where a session- fixation flaw allows an attacker to force arbitrary session identifiers while the system does not invalidate an existing session after a successful login. This gap enables potential theft of an authenticated...

CVE-2016-9455

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: www/admin/banner-acl.php, www/admin/banner-activate.php, www/admin/banner-advanced.php, www/admin/banner-modify.php,...

CVE-2016-9454

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...

CVE-2016-9454

CVE-2016-9454 affects Revive Adserver prior to version 3.2.3, where the banner image URL for external banners could be improperly escaped in most banner-related pages, enabling a persistent XSS via the Revive Adserver user interface. The vulnerability requires a trusted, non-admin account and is ...

CVE-2016-9471

The vulnerability CVE-2016-9471 affects Revive Adserver prior to 3.2.5 and 4.0.0, caused by insufficient filtering of usernames during user creation. Specifically, control characters were not filtered, allowing apparently identical usernames to co-exist and enabling potential user spoofing. Explo...

CVE-2016-9457

Revive Adserver CVE-2016-9457 affects Revive Adserver prior to version 3.2.3. The vulnerability is a Reflected XSS in www/admin/stats.php, exploitable via multiple unsanitised/escaped parameters (e.g., setPerPage, pageId, bannerid, period_start, period_end). Impact is XSS on pages reflecting user...

CVE-2016-9455

Revive Adserver before 3.2.3 is affected by a Cross-Site Request Forgery (CSRF) in multiple admin scripts: banner-acl.php, banner-activate.php, banner-advanced.php, banner-modify.php, banner-swf.php, banner-zone.php, tracker-modify.php. Root cause is CSRF in the Web UI, enabling unauthorized acti...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Session fixation

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

Cross site scripting

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...