CVE-2021-31583

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in...

CVE-2021-31583

Affected software: Sipwise C5 NGCP WWW Admin (NGCP CE 3.0 era; also NGCP www_admin 3.6.7). Description and connected sources document multiple authenticated stored and reflected XSS vulnerabilities arising when input to several scripts/parameters is not properly sanitized. Confirmed vulnerable lo...

CVE-2021-31583: Improper Neutralization of Input During Web Page Generation

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in...

PT-2020-19979

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.0.5 Description A remote attacker could trick logged-in users into opening a specifically crafted link, redirecting them to any destination. The CSRF protection of the "/www/admin/-modify.php" endpoint could...

CVE-2016-9128

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...

CVE-2016-9128

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted U...

CVE-2016-9455

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: "www/admin/banner-acl.php", "www/admin/banner-activate.php", "www/admin/banner-advanced.php", "www/admin/banner-modify.php",...

PT-2017-10148

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue affects the "www/admin/stats.php" endpoint, which is vulnerable to reflected XSS attacks. This is due to multiple parameters not being properly sanitised or escaped when displayed,...

CVE-2016-9457: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, periodstart, periodend, and possibly others...

CVE-2016-9455: Cross-Site Request Forgery (CSRF)

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery CSRF. A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: www/admin/banner-acl.php, www/admin/banner-activate.php, www/admin/banner-advanced.php, www/admin/banner-modify.php,...

PT-2017-17146

Name of the Vulnerable Software and Affected Versions Gargaj/wuhu through 2017-03-08 Description The issue is related to a reflected XSS in the wuhu-master/www admin/users.php file, specifically affecting the id parameter. Recommendations For Gargaj/wuhu through 2017-03-08, avoid using the id...

CVE-2014-8793

Cross-site scripting XSS vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refreshpage parameter to www/admin/report-generate.php...

PT-2014-8734

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.0.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the refresh page parameter to "www/admin/report-generate.php". Recommendations For versions...

CVE-2014-8793: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refreshpage parameter to www/admin/report-generate.php...

CVE-2013-3515

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

PT-2013-4449

Name of the Vulnerable Software and Affected Versions OpenX Source versions 2.8.10 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the package parameter to...

CVE-2013-3515: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 package parameter to www/admin/plugin-index.php or the 2 group parameter to www/admin/plugin-settings.php...

Authentication flaw

Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files...

CVE-2009-4830: Improper Authentication

Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files...