CVSS: 6.1EPSS: 2%CPEs: 1EXPL: 1CVE-2023-38040
https://notcve.org/view.php?id=CVE-2023-38040
A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions.. Existe una vulnerabilidad XSS Reflejada en Revive Adserver 5.4.1 y versiones anteriores. • https://hackerone.com/reports/1694171 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-22948
https://notcve.org/view.php?id=CVE-2021-22948
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account. Una vulnerabilidad en la generación de IDs de sesión en revive-adserver versiones anteriores a 5.3.0, basada en la función PHP uniqid() criptográficamente no segura. Bajo algunas circunstancias, un atacante podría teóricamente ser capaz de forzar los ID de sesión para hacerse con una cuenta específica • https://hackerone.com/reports/1187820 https://www.revive-adserver.com/security/revive-sa-2021-005 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-22889
https://notcve.org/view.php?id=CVE-2021-22889
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code. Revive Adserver versiones anteriores a v5.2.0, es susceptible a una vulnerabilidad XSS reflejado en el parámetro "statsBreakdown" del archivo stats.php (y posiblemente otros scripts) debido a que las comillas simples no se escapan. Un atacante podría engañar a un usuario con acceso a la interfaz de usuario de una instancia de Revive Adserver para que haga clic en una URL diseñada específicamente y presionar una determinada combinación de teclas para ejecutar el código JavaScript inyectado • https://github.com/revive-adserver/revive-adserver/commit/2f868414 https://hackerone.com/reports/1097217 https://www.revive-adserver.com/security/revive-sa-2021-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-22888
https://notcve.org/view.php?id=CVE-2021-22888
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code. Revive Adserver versiones anteriores a v5.2.0, es susceptible a una vulnerabilidad de tipo XSS reflejado en el parámetro "status" del archivo campaign-zone-zones.php. Un atacante podría engañar a un usuario con acceso a la interfaz de usuario de una instancia de Revive Adserver para hacer clic en una URL específicamente diseñada y ejecutar código JavaScript inyectado • https://github.com/revive-adserver/revive-adserver/commit/f472d890 https://hackerone.com/reports/1097979 https://www.revive-adserver.com/security/revive-sa-2021-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-22875 – Revive Adserver 5.1.0 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2021-22875
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter. Revive Adserver versiones anteriores a 5.1.1, es susceptible a una vulnerabilidad de tipo XSS reflejado en el archivo stats.php por medio del parámetro "setPerPage" Revive Adserver versions 5.1.0 and below suffer from multiple reflective cross site scripting vulnerabilities. • https://github.com/revive-adserver/revive-adserver/commit/6f46076a https://hackerone.com/reports/1083376 https://www.revive-adserver.com/security/revive-sa-2021-002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •