Filtered by vendor Revive-adserver
Subscribe
Total
46 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-22948 | 1 Revive-adserver | 1 Revive Adserver | 2021-09-29 | 4.3 MEDIUM | 7.1 HIGH |
| Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account. | |||||
| CVE-2021-22889 | 1 Revive-adserver | 1 Revive Adserver | 2021-03-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code. | |||||
| CVE-2021-22888 | 1 Revive-adserver | 1 Revive Adserver | 2021-03-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code. | |||||
| CVE-2021-22872 | 1 Revive-adserver | 1 Revive Adserver | 2021-02-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable. | |||||
| CVE-2021-22873 | 1 Revive-adserver | 1 Revive Adserver | 2021-02-02 | 5.8 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability. | |||||
| CVE-2021-22871 | 1 Revive-adserver | 1 Revive Adserver | 2021-02-01 | 3.5 LOW | 4.8 MEDIUM |
| Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability. | |||||
| CVE-2021-22875 | 1 Revive-adserver | 1 Revive Adserver | 2021-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter. | |||||
| CVE-2021-22874 | 1 Revive-adserver | 1 Revive Adserver | 2021-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter. | |||||
| CVE-2020-8142 | 1 Revive-adserver | 1 Revive Adserver | 2020-04-07 | 4.6 MEDIUM | 6.8 MEDIUM |
| A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was however possible for anyone with access to a Revive Adserver admin user interface to bypass such check and change e-email address or password of the currently logged in user by altering the form payload.The attack requires physical access to the user interface of a logged in user. If the POST payload was altered by turning the “pwold” parameter into an array, Revive Adserver would fetch and authorise the operation even if no password was provided. | |||||
| CVE-2020-8143 | 1 Revive-adserver | 1 Revive Adserver | 2020-04-06 | 5.8 MEDIUM | 6.1 MEDIUM |
| An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/*-modify.php” could be skipped if no meaningful parameter was sent. No action was performed, but the user was still redirected to the target page, specified via the “returnurl” GET parameter. | |||||
| CVE-2020-8115 | 1 Revive-adserver | 1 Revive Adserver | 2020-02-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim. | |||||
| CVE-2019-5440 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 6.8 MEDIUM | 8.1 HIGH |
| Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header. | |||||
| CVE-2019-5433 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 5.8 MEDIUM | 5.4 MEDIUM |
| A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0. | |||||
| CVE-2016-9470 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 9.3 HIGH | 9.0 CRITICAL |
| Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain. | |||||
| CVE-2016-9472 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective. | |||||
| CVE-2016-9128 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL. | |||||
| CVE-2016-9129 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username. | |||||
| CVE-2016-9127 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 6.8 MEDIUM | 8.8 HIGH |
| Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed. | |||||
| CVE-2016-9126 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account. | |||||
| CVE-2016-9130 | 1 Revive-adserver | 1 Revive Adserver | 2019-10-09 | 3.5 LOW | 5.4 MEDIUM |
| Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script. | |||||