Revive Adserver@* Security Vulnerabilities and Issues — Revive Adserver@* CVE List

Lucene search

Revive-adserverRevive Adserver*

47 matches found

CVE•added 2019/05/28 7:29 p.m.•107 views

CVE-2019-5440

Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver

8.1CVSS8.3AI score0.00377EPSS

CVE•added 2020/04/03 9:15 p.m.•103 views

CVE-2020-8142

A security restriction bypass vulnerability has been discovered in Revive Adserver version

6.8CVSS6.5AI score0.00085EPSS

CVE•added 2020/04/03 9:15 p.m.•100 views

CVE-2020-8143

An Open Redirect vulnerability was discovered in Revive Adserver version

6.1CVSS6.1AI score0.06369EPSS

CVE•added 2020/02/04 8:15 p.m.•86 views

CVE-2020-8115

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver

6.1CVSS6.3AI score0.55788EPSS

CVE•added 2021/01/26 6:16 p.m.•84 views

CVE-2021-22873

Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third p...

6.1CVSS6.1AI score0.66609EPSS

CVE•added 2014/12/19 3:59 p.m.•59 views

CVE-2014-8793

Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refresh_page parameter to www/admin/report-generate.php.

4.3CVSS5.6AI score0.00445EPSS

CVE•added 2015/10/14 7:59 p.m.•50 views

CVE-2015-7371

Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request.

5CVSS6.8AI score0.00734EPSS

CVE•added 2013/12/28 4:53 a.m.•49 views

CVE-2013-7149

SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.

7.5CVSS8.5AI score0.00517EPSS

CVE•added 2015/10/14 7:59 p.m.•48 views

CVE-2015-7365

Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of an uploaded file containing errors.

4.3CVSS5.8AI score0.00256EPSS

CVE•added 2017/03/28 2:59 a.m.•46 views

CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trus...

9.3CVSS9.2AI score0.0054EPSS

CVE•added 2017/03/03 3:59 p.m.•46 views

CVE-2017-5830

Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.

9.8CVSS9.7AI score0.03733EPSS

CVE•added 2015/10/14 7:59 p.m.•45 views

CVE-2015-7373

Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET parameter, which is not properly handled in a banner.

4.3CVSS5.7AI score0.00256EPSS

CVE•added 2015/10/14 7:59 p.m.•44 views

CVE-2015-7368

Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache.

2.1CVSS5.8AI score0.00062EPSS

CVE•added 2015/10/14 7:59 p.m.•43 views

CVE-2015-7364

The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token.

6.8CVSS6.8AI score0.0017EPSS

CVE•added 2015/10/14 7:59 p.m.•42 views

CVE-2015-7367

Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been (1) deleted or (2) unlinked.

7.5CVSS6.8AI score0.00656EPSS

CVE•added 2015/10/14 7:59 p.m.•42 views

CVE-2015-7369

The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct cross domain attacks via unspecified vectors.

7.5CVSS6.7AI score0.00844EPSS

CVE•added 2021/03/25 8:15 p.m.•42 views

CVE-2021-22888

Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the status parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript...

6.1CVSS6AI score0.00815EPSS

CVE•added 2015/10/14 7:59 p.m.•41 views

CVE-2015-7366

Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that (1) perform certain plugin actions and possibly cause a denial of service (disabled core plugins) via unknown vectors or (2) chan...

6.8CVSS8.2AI score0.00227EPSS

CVE•added 2021/01/26 6:16 p.m.•41 views

CVE-2021-22871

Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.

4.8CVSS4.9AI score0.0094EPSS

CVE•added 2015/10/14 7:59 p.m.•40 views

CVE-2015-7372

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.

7.5CVSS7.2AI score0.01953EPSS

CVE•added 2015/10/14 7:59 p.m.•38 views

CVE-2015-7370

Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and...

4.3CVSS5.9AI score0.00452EPSS

CVE•added 2014/04/25 2:15 p.m.•37 views

CVE-2013-5954

Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/ba...

6.8CVSS7.3AI score0.05906EPSS

CVE•added 2014/12/19 3:59 p.m.•37 views

CVE-2014-8875

The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.

5CVSS6.5AI score0.00734EPSS

CVE•added 2017/03/28 2:59 a.m.•37 views

CVE-2016-9125

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal...

9.8CVSS9.3AI score0.00691EPSS

CVE•added 2023/09/17 5:15 a.m.•37 views

CVE-2023-38040

A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..

6.1CVSS5.9AI score0.05715EPSS

CVE•added 2021/01/26 6:16 p.m.•36 views

CVE-2021-22872

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encod...

6.1CVSS5.8AI score0.55788EPSS

CVE•added 2021/03/25 8:15 p.m.•36 views

CVE-2021-22889

Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the statsBreakdown parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking...

6.1CVSS6.1AI score0.00815EPSS

CVE•added 2014/12/19 3:59 p.m.•35 views

CVE-2014-9407

Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) u...

6.8CVSS7.4AI score0.00116EPSS

CVE•added 2017/03/28 2:59 a.m.•35 views

CVE-2016-9127

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with ...

8.8CVSS8.9AI score0.00136EPSS

CVE•added 2017/03/28 2:59 a.m.•35 views

CVE-2016-9456

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.

8.8CVSS8.8AI score0.0015EPSS

CVE•added 2017/03/03 3:59 p.m.•35 views

CVE-2017-5832

Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.

5.4CVSS5.2AI score0.00231EPSS

CVE•added 2019/05/06 5:29 p.m.•35 views

CVE-2019-5433

A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was ...

5.8CVSS5.3AI score0.00161EPSS

CVE•added 2017/03/28 2:59 a.m.•34 views

CVE-2016-9130

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.

5.4CVSS5.5AI score0.00236EPSS

CVE•added 2017/03/28 2:59 a.m.•34 views

CVE-2016-9455

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: www/admin/banner-acl.php, www/admin/banner-activate.php, www/admin/banner-advanced.php, www/admin/banner-modify.php, www/admin/banner-...

8.8CVSS8.7AI score0.00134EPSS

CVE•added 2017/03/28 2:59 a.m.•34 views

CVE-2016-9471

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fact...

3.1CVSS4.1AI score0.00271EPSS

CVE•added 2017/03/28 2:59 a.m.•33 views

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to a...

5.4CVSS5.4AI score0.00264EPSS

CVE•added 2017/03/28 2:59 a.m.•33 views

CVE-2016-9129

Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such informa...

5.3CVSS5.5AI score0.00223EPSS

CVE•added 2017/03/03 3:59 p.m.•33 views

CVE-2017-5833

Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

6.1CVSS6.2AI score0.00308EPSS

CVE•added 2021/01/28 5:15 p.m.•33 views

CVE-2021-22875

Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the setPerPage parameter.

6.1CVSS5.9AI score0.00701EPSS

CVE•added 2017/03/28 2:59 a.m.•32 views

CVE-2016-9472

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow...

5.4CVSS5.2AI score0.00364EPSS

CVE•added 2021/09/23 1:15 p.m.•32 views

CVE-2021-22948

Vulnerability in the generation of session IDs in revive-adserver

7.1CVSS6.6AI score0.00545EPSS

CVE•added 2017/03/28 2:59 a.m.•31 views

CVE-2016-9124

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users durin...

9.8CVSS9.4AI score0.0035EPSS

CVE•added 2017/03/03 3:59 p.m.•31 views

CVE-2017-5831

Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.

5.9CVSS6.1AI score0.00222EPSS

CVE•added 2021/01/28 5:15 p.m.•31 views

CVE-2021-22874

Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the period_preset parameter.

6.1CVSS5.9AI score0.00701EPSS

CVE•added 2017/03/28 2:59 a.m.•30 views

CVE-2016-9457

Revive Adserver before 3.2.3 suffers from Reflected XSS. www/admin/stats.php is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, period_start, period_end, and possibly others.

5.4CVSS5.6AI score0.00213EPSS

CVE•added 2017/03/28 2:59 a.m.•27 views

CVE-2016-9128

Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL...

5.4CVSS5.4AI score0.00373EPSS

CVE•added 2017/03/28 2:59 a.m.•26 views

CVE-2016-9454

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.

5.4CVSS5.6AI score0.00317EPSS