CVE-2016-9124: Improper Restriction of Excessive Authentication Attempts

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users...

CVE-2016-9470: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...

PT-2017-9961

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue allows for password-guessing attacks due to improper restriction of excessive authentication attempts on the login page. A countermeasure has been introduced, including a random del...

PT-2017-9963

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue arises from improper escaping of usernames in the audit trail widget of the dashboard upon login, allowing for persistent XSS attacks. An authenticated user with sufficient privileg...

CVE-2016-9128: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...

PT-2017-9965

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue is related to reflected XSS, where the affiliate-preview.php script in the www/admin directory is vulnerable to a reflected XSS attack. This could allow an attacker to steal the...

PT-2017-9964

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The password recovery form in Revive Adserver is susceptible to Cross-Site Request Forgery CSRF attacks. This issue could be exploited to send a large number of password recovery emails to...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

Session fixation

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

Design/Logic Flaw

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

Cross site scripting

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2017-5832

Revive Adserver (open source ad management) is affected by CVE-2017-5832: an XSS in the handling of user email addresses that allows remote authenticated users to inject arbitrary script/HTML. The vulnerability affects Revive Adserver versions before 4.0.1. Exploitation requires authentication; a...