Vulnerabilities (CVE)

Filtered by vendor Revive-adserver Subscribe
Filtered by product Revive Adserver
Total 46 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-7368 1 Revive-adserver 1 Revive Adserver 2024-02-04 2.1 LOW N/A
Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache.
CVE-2014-8875 1 Revive-adserver 1 Revive Adserver 2024-02-04 5.0 MEDIUM N/A
The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request, aka an XML Entity Expansion (XEE) attack.
CVE-2014-8793 1 Revive-adserver 1 Revive Adserver 2024-02-04 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via the refresh_page parameter to www/admin/report-generate.php.
CVE-2013-5954 2 Openx, Revive-adserver 2 Openx, Revive Adserver 2024-02-04 6.8 MEDIUM N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php.
CVE-2014-9407 1 Revive-adserver 1 Revive Adserver 2024-02-04 6.8 MEDIUM N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/.
CVE-2013-7149 2 Openx, Revive-adserver 2 Openx, Revive Adserver 2024-02-04 7.5 HIGH N/A
SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method.