RE
Product
revive-adserver
67
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 9Medium 37Low 2
Watch
Add revive-adserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9471 | 3.1 | Mar 28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection Affected: through 3.2.4; 4.0.0 |
| CVE-2025-52666 | 2.7 | Nov 20 | Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console… Affected: through 5.5.2; 6.0.0 through 6.0.1 |
| CVE-2015-7373 | – | Oct 14 | Cross-site scripting (XSS) vulnerability in the "magic-macros" feature in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via a GET… Affected: through 3.2.1 |
| CVE-2015-7372 | – | Oct 14 | Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a Affected: through 3.2.1 |
| CVE-2015-7371 | – | Oct 14 | Revive Adserver before 3.2.2 does not restrict access to run-mpe.php, which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service… Affected: through 3.2.1 |
| CVE-2015-7370 | – | Oct 14 | Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release… Affected: through 3.2.1 |
| CVE-2015-7369 | – | Oct 14 | The default Flash cross-domain policy (crossdomain.xml) in Revive Adserver before 3.2.2 does not restrict access cross domain access, which allows remote attackers to conduct… Affected: through 3.2.1 |
| CVE-2015-7368 | – | Oct 14 | Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via… Affected: through 3.2.1 |
| CVE-2015-7367 | – | Oct 14 | Revive Adserver before 3.2.2 allows remote attackers to perform unspecified actions by leveraging an unexpired session after the user has been (1) deleted or (2) unlinked Affected: through 3.2.1 |
| CVE-2015-7366 | – | Oct 14 | Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that (1)… Affected: through 3.2.1 |
| CVE-2015-7365 | – | Oct 14 | Cross-site scripting (XSS) vulnerability in the plugin upgrade form in Revive Adserver before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename… Affected: through 3.2.1 |
| CVE-2015-7364 | – | Oct 14 | The HTML_Quickform library, as used in Revive Adserver before 3.2.2, allows remote attackers to bypass the CSRF protection mechanism via an empty token Affected: through 3.2.1 |
| CVE-2014-9407 | – | Dec 19 | Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that… Affected: through 3.0.4 |
| CVE-2014-8875 | – | Dec 19 | The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted… Affected: through 3.0.5 |
| CVE-2014-8793 | – | Dec 19 | Cross-site scripting (XSS) vulnerability in lib/max/Admin/UI/Field/PublisherIdField.php in Revive Adserver before 3.0.6 allows remote attackers to inject arbitrary web script or… Affected: through 3.0.5 |
| CVE-2013-5954 | – | Apr 25 | Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that… Affected: through 3.0.4 |
| CVE-2013-7149 | – | Dec 28 | SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows… Affected: through 3.0.1; 3.0.0 |