939 matches found
CVE-2015-7368: Exposure of Sensitive Information to an Unauthorized Actor
Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache...
PT-2015-7531
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows local users to obtain sensitive information via the web browser cache because the software does not send the appropriate Cache-Control HTTP headers in responses for admin UI...
CVE-2015-7365: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors...
PT-2015-7530
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been deleted or unlinked. Recommendations For versions prior to 3.2.2,...
PT-2015-7527
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to bypass the CSRF protection mechanism via an empty token. This is related to the HTML Quickform library used in Revive Adserver. Recommendations For versio...
CVE-2015-7372: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...
PT-2015-7534
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to cause a denial of service, potentially leading to resource consumption, by directly requesting a specific endpoint. Recommendations For versions prior to...
CVE-2015-7367: Improper Access Control
Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been 1 deleted or 2 unlinked...
PT-2015-7536
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description A cross-site scripting XSS issue exists due to improper handling of a GET parameter in the "magic-macros" feature of the banner, allowing remote attackers to inject arbitrary web script or...
PT-2015-7532
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue concerns the default Flash cross-domain policy, specifically the crossdomain.xml file, which does not properly restrict cross-domain access. This allows remote attackers to conduct...
CVE-2015-7371: Undefined Security Weakness
Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service resource consumption via a direct request...
PT-2015-7535
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the layerstyle parameter. Recommendations...
CVE-2015-7364: Cross-Site Request Forgery (CSRF)
The HTMLQuickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token...
PT-2015-7528
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by uploading a file containing errors via the plugin upgrade form,...
CVE-2015-7369: Improper Access Control
The default Flash cross-domain policy crossdomain.xml in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors...
CVE-2015-7373: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner...
CVE-2015-7366: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...
PT-2015-7529
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.2 Description The issue allows remote attackers to hijack user authentication for certain requests, potentially causing a denial of service or modifying user account details. This can be achieved via craft...
Revive Adserver 3.2.1 Multiple Vulnerabilities
Revive Adserver versions 3.2.1 and below suffer from improper access controls, cross site request forgery, cross site scripting, local file inclusion, and various other vulnerabilities. ========================================================================...
