CVE-2015-7372

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...

CVE-2015-7369

The default Flash cross-domain policy crossdomain.xml in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors...

CVE-2015-7365

Revive Adserver is affected by CVE-2015-7365: a reflected XSS in the plugin upgrade form where filenames of uploaded files containing errors are not properly escaped. The vulnerability affects Revive Adserver versions

CVE-2015-7373

Cross-site scripting XSS vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner...

CVE-2015-7368

Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache...

CVE-2015-7364

The HTMLQuickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token...

CVE-2015-7367

Revive Adserver (versions

CVE-2015-7372

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...

CVE-2015-7368: Exposure of Sensitive Information to an Unauthorized Actor

Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache...

CVE-2015-7366: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...

CVE-2015-7373: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner...

PT-2015-7530

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked. Recommendations For versions prior to 3.2.2,...

PT-2015-7527

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to bypass the CSRF protection mechanism via an empty token. This is related to the HTML Quickform library used in Revive Adserver. Recommendations For versio...

PT-2015-7535

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the layerstyle parameter. Recommendations...

CVE-2015-7372: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...

PT-2015-7534

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to cause a denial of service, potentially leading to resource consumption, by directly requesting a specific endpoint. Recommendations For versions prior to...

PT-2015-7536

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description A cross-site scripting XSS issue exists due to improper handling of a GET parameter in the "magic-macros" feature of the banner, allowing remote attackers to inject arbitrary web script or...

PT-2015-7532

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue concerns the default Flash cross-domain policy, specifically the crossdomain.xml file, which does not properly restrict cross-domain access. This allows remote attackers to conduct...

CVE-2015-7369: Improper Access Control

The default Flash cross-domain policy crossdomain.xml in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors...

PT-2015-7531

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows local users to obtain sensitive information via the web browser cache because the software does not send the appropriate Cache-Control HTTP headers in responses for admin UI...