CVSS: 6.8EPSS: 1%CPEs: 13EXPL: 4CVE-2013-5954 – OpenX 2.8.x - Multiple Cross-Site Request Forgery Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-5954
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php. Múltiples vulnerabilidades de CSRF en OpenX 2.8.11 y anteriores permiten a atacantes remotos secuestrar la autenticación de administradores para solicitudes que eliminan (1) usuarios a través de admin/agency-user-unlink.php, (2) anunciantes a través de admin/advertiser-delete.php, (3) banners a través de admin/banner-delete.php, (4) campañas a través de admin/campaign-delete.php, (5) canales a través de admin/channel-delete.php, (6) sitios web afiliados a través de admin/affiliate-delete.php o (7) zonas a través de admin/zone-delete.php. OpenX version 2.8.11 suffers from multiple cross site request forgery vulnerabilities. • https://www.exploit-db.com/exploits/39117 http://packetstormsecurity.com/files/125735 http://seclists.org/fulldisclosure/2014/Mar/270 http://seclists.org/fulldisclosure/2014/May/68 http://www.revive-adserver.com/security/revive-sa-2014-001 http://www.securityfocus.com/archive/1/532108/100/0/threaded http://www.securityfocus.com/bid/66251 https://exchange.xforce.ibmcloud.com/vulnerabilities/91889 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2013-7149
https://notcve.org/view.php?id=CVE-2013-7149
SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method. Vulnerabilidad de inyección SQL en www / entrega / axmlrpc.php (también conocido como el XML-RPC invocación de entrega de script) en Revive Adserver antes de 3.0.2, y OpenX Fuente 2.8.11 y anteriores, permite a atacantes remotos ejecutar comandos SQL a través del parámetro de lo que a un método de XML-RPC. • http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1 http://www.revive-adserver.com/security/REVIVE-SA-2013-001 http://www.securityfocus.com/archive/1/530471/30/0/threaded • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •