CVE-2016-9126

Affected software: Revive Adserver prior to 3.2.3. Issue: persistent XSS in the audit trail widget on login due to inadequate escaping of usernames; an authenticated user who can create other users could leverage this to access the administrator account. Impact (per sources): CVSS metrics show ba...

CVE-2016-9472

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narr...

CVE-2016-9471

The vulnerability CVE-2016-9471 affects Revive Adserver prior to 3.2.5 and 4.0.0, caused by insufficient filtering of usernames during user creation. Specifically, control characters were not filtered, allowing apparently identical usernames to co-exist and enabling potential user spoofing. Explo...

CVE-2016-9455

Revive Adserver before 3.2.3 is affected by a Cross-Site Request Forgery (CSRF) in multiple admin scripts: banner-acl.php, banner-activate.php, banner-advanced.php, banner-modify.php, banner-swf.php, banner-zone.php, tracker-modify.php. Root cause is CSRF in the Web UI, enabling unauthorized acti...

CVE-2016-9454

CVE-2016-9454 affects Revive Adserver prior to version 3.2.3, where the banner image URL for external banners could be improperly escaped in most banner-related pages, enabling a persistent XSS via the Revive Adserver user interface. The vulnerability requires a trusted, non-admin account and is ...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5832

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

CVE-2017-5833

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address...

Session fixation

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...

Cross site scripting

Cross-site scripting XSS vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Design/Logic Flaw

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts...

CVE-2017-5832

Revive Adserver (open source ad management) is affected by CVE-2017-5832: an XSS in the handling of user email addresses that allows remote authenticated users to inject arbitrary script/HTML. The vulnerability affects Revive Adserver versions before 4.0.1. Exploitation requires authentication; a...

CVE-2017-5833

CVE-2017-5833 affects Revive Adserver prior to 4.0.1. An XSS in the invocation code generation for interstitial zones allows remote attackers to inject arbitrary script or HTML via unspecified parameters. The CVSS data indicates a network-accessible vulnerability with low attack complexity (AV:N/...

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID...