CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 4CVE-2014-2230 – OpenX 2.8.10 Open Redirect
https://notcve.org/view.php?id=CVE-2014-2230
16 Oct 2014 — Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php. Vulnerabilidad de redirección abierta en la función header en adclick.php en OpenX 2.8.10 y anteriores permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a través de una URL en (1)... • https://packetstorm.news/files/id/128718 •
CVSS: 6.8EPSS: 5%CPEs: 13EXPL: 5CVE-2013-5954 – OpenX 2.8.x - Multiple Cross-Site Request Forgery Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-5954
15 Mar 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php. Múltiples vul... • https://packetstorm.news/files/id/125735 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2013-7149 – Revive Adserver 3.0.1 SQL Injection
https://notcve.org/view.php?id=CVE-2013-7149
20 Dec 2013 — SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method. Vulnerabilidad de inyección SQL en www / entrega / axmlrpc.php (también conocido como el XML-RPC invocación de entrega de script) en Revive Adserver antes de 3.0.2, y OpenX Fuente 2.8.11 y anteriores, permite a atacantes remotos ejecutar ... • http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 8%CPEs: 27EXPL: 4CVE-2013-3514 – OpenX 2.8.10 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-3514
03 Jul 2013 — Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files. Múltiples vulnerabilidades de salto de directorio en OpenX anterior a 2.8.10 revisión 82710 permite a administra... • https://packetstorm.news/files/id/122281 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 6%CPEs: 23EXPL: 5CVE-2013-3515 – OpenX 2.8.10 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-3515
03 Jul 2013 — Multiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php. Múltiples vulnerabilidades XSS en OpenX Source 2.8.10 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de lso parámetros (1) package a www/admin/plugin-index.php o (2) group a www/admin/plugin-sett... • https://packetstorm.news/files/id/122281 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 50%CPEs: 5EXPL: 1CVE-2009-4098 – OpenX - 'banner-edit.php' Arbitrary File Upload / PHP Code Execution
https://notcve.org/view.php?id=CVE-2009-4098
28 Nov 2009 — Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory. Vulnerabilidad de subida de archivos sin restricción en banner-edit.php en OpenX adserver v2.8.1 y anteriores permite a usuarios autenticados remotamente con permisos de subida banner / file, eje... • https://www.exploit-db.com/exploits/16903 • CWE-20: Improper Input Validation •