deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6455
Published: 2017-03-27
Description: NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
CVSS Score: 7.0 (HIGH)
CWE: CWE-94
References: http://support.ntp.org/bin/view/Main/NtpBug3384; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97074
CVE: CVE-2017-6458
Published: 2017-03-27
Description: Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/142284/Slackware-Security-Advisory-ntp-Updates.html; http://seclists.org/fulldisclosure/2017/Nov/7; http://seclists.org/fulldisclosure/2017/Sep/62
CVE: CVE-2017-6459
Published: 2017-03-27
Description: The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://support.ntp.org/bin/view/Main/NtpBug3382; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97076
CVE: CVE-2017-6460
Published: 2017-03-27
Description: Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://support.ntp.org/bin/view/Main/NtpBug3377; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97052
CVE: CVE-2017-6462
Published: 2017-03-27
Description: Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://support.ntp.org/bin/view/Main/NtpBug3388; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97045
CVE: CVE-2017-6463
Published: 2017-03-27
Description: NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://support.ntp.org/bin/view/Main/NtpBug3387; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97049
CVE: CVE-2017-6464
Published: 2017-03-27
Description: NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://support.ntp.org/bin/view/Main/NtpBug3389; http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu; http://www.securityfocus.com/bid/97050
CVE: CVE-2017-6542
Published: 2017-03-27
Description: The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2017-03/msg00055.html; http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html; http://www.securityfocus.com/bid/97156
CVE: CVE-2017-7183
Published: 2017-03-27
Description: The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP protocol message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/141705/ExtraPuTTY-029_rc2-Denial-Of-Service.html; http://www.securityfocus.com/archive/1/540300/100/0/threaded; http://www.securityfocus.com/bid/96973
CVE: CVE-2017-7191
Published: 2017-03-27
Description: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/97185; https://github.com/irssi/irssi/commit/77b2631c78461965bc9a7414aae206b5c514e1b3; https://irssi.org/security/irssi_sa_2017_03.txt
CVE: CVE-2017-7271
Published: 2017-03-27
Description: Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97167; http://www.yiiframework.com/news/123/yii-2-0-11-is-released/; https://github.com/yiisoft/yii2/commit/97171a0db7cda0a49931ee0c3b998ef50bd06756
CVE: CVE-2017-7272
Published: 2017-03-27
Description: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVSS Score: 7.4 (HIGH)
CWE: CWE-918
References: http://www.securityfocus.com/bid/97178; http://www.securitytracker.com/id/1038158; https://bugs.php.net/bug.php?id=74216
CVE: CVE-2017-7273
Published: 2017-03-27
Description: The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.
CVSS Score: 6.6 (MEDIUM)
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1ebb71143758f45dc0fa76e2f48429e13b16d110; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4faec4a2ef5dd481682cc155cb9ea14ba2534b76; http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.4
CVE: CVE-2017-7274
Published: 2017-03-27
Description: The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PE file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/97181; https://github.com/radare/radare2/commit/7ab66cca5bbdf6cb2d69339ef4f513d95e532dbf; https://github.com/radare/radare2/issues/7152
CVE: CVE-2016-9252
Published: 2017-03-27
Description: The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.securitytracker.com/id/1038132; https://support.f5.com/csp/article/K46535047; http://www.securitytracker.com/id/1038132
CVE: CVE-2017-7275
Published: 2017-03-27
Description: The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97166; https://blogs.gentoo.org/ago/2017/03/27/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862-and-cve-2016-8866/; https://github.com/ImageMagick/ImageMagick/issues/271
CVE: CVE-2017-5237
Published: 2017-03-27
Description: Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/97186; https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities; http://www.securityfocus.com/bid/97186
CVE: CVE-2017-5238
Published: 2017-03-27
Description: Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97194; https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities; http://www.securityfocus.com/bid/97194
CVE: CVE-2017-5239
Published: 2017-03-27
Description: Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/97194; https://community.rapid7.com/community/infosec/blog/2017/03/27/r7-2015-28-multiple-eview-ev-07s-gps-tracker-vulnerabilities; http://www.securityfocus.com/bid/97194
CVE: CVE-2016-6056
Published: 2017-03-27
Description: IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000442.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22000442; http://www.securityfocus.com/bid/96975; http://www.ibm.com/support/docview.wss?uid=swg22000442
CVE: CVE-2016-6102
Published: 2017-03-27
Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM Reference #: 2000359.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22000359; http://www.securityfocus.com/bid/96976; http://www.securitytracker.com/id/1038093
CVE: CVE-2016-8960
Published: 2017-03-27
Description: IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie value from its HTTP request and then reusing it in subsequent requests. IBM Reference #: 1993718.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.ibm.com/support/docview.wss?uid=swg21993718; http://www.securityfocus.com/bid/96963; http://www.ibm.com/support/docview.wss?uid=swg21993718
CVE: CVE-2016-9737
Published: 2017-03-27
Description: IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1996200.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21996200; http://www.securityfocus.com/bid/97064; http://www.ibm.com/support/docview.wss?uid=swg21996200
CVE: CVE-2017-1120
Published: 2017-03-27
Description: IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000152.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22000152; http://www.securityfocus.com/bid/97075; http://www.securitytracker.com/id/1038146
CVE: CVE-2017-1142
Published: 2017-03-27
Description: IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Reference #: 1998874.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21998874; http://www.securityfocus.com/bid/97081; http://www.ibm.com/support/docview.wss?uid=swg21998874
CVE: CVE-2017-1143
Published: 2017-03-27
Description: IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21998874; http://www.securityfocus.com/bid/97079; http://www.ibm.com/support/docview.wss?uid=swg21998874
CVE: CVE-2017-1153
Published: 2017-03-27
Description: IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do not have access to. IBM Reference #: 1999563.
CVSS Score: 8.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg21999563; http://www.securityfocus.com/bid/97066; http://www.ibm.com/support/docview.wss?uid=swg21999563
CVE: CVE-2017-6964
Published: 2017-03-28
Description: dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-device to execute code, which was intended to run as an unprivileged user, as root. This affects eject through 2.1.5+deb1+cvs20081104-13.1 on Debian, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, and eject before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-252
References: http://www.debian.org/security/2017/dsa-3823; http://www.securityfocus.com/bid/97154; https://launchpad.net/bugs/1673627
CVE: CVE-2016-9121
Published: 2017-03-28
Description: go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-326
References: http://www.openwall.com/lists/oss-security/2016/11/03/1; https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507; https://hackerone.com/reports/164590
CVE: CVE-2016-9122
Published: 2017-03-28
Description: go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/03/1; https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6; https://hackerone.com/reports/169629
CVE: CVE-2016-9123
Published: 2017-03-28
Description: go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2016/11/03/1; https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96; https://hackerone.com/reports/165170
CVE: CVE-2016-9124
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-287
References: https://github.com/revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9; https://hackerone.com/reports/96115; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9125
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://github.com/revive-adserver/revive-adserver/commit/[PII_REDACTED]eabbb208961c36149f41cc8159fb39; https://hackerone.com/reports/93809; https://hackerone.com/reports/93813
CVE: CVE-2016-9126
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec; https://hackerone.com/reports/97073; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9127
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/revive-adserver/revive-adserver/commit/3aaebcc765797d2c684e031f2836e0a69d6b7bc2; https://hackerone.com/reports/99452; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9128
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3; https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74; https://hackerone.com/reports/99004
CVE: CVE-2016-9129
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-200
References: https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5; https://hackerone.com/reports/98612; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9130
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83; https://www.revive-adserver.com/security/revive-sa-2016-001/; https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83
CVE: CVE-2016-9454
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/83964; https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9455
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/83964; https://github.com/revive-adserver/revive-adserver/commit/65a9c8119b4bc7493fd957e1a8d6f6f731298b45; https://hackerone.com/reports/97123
CVE: CVE-2016-9456
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/83964; https://github.com/revive-adserver/revive-adserver/commit/e563ca61e4f3b7210cb61f53284adaa8aef4a49a; https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE: CVE-2016-9457
Published: 2017-03-28
Description: Revive Adserver before 3.2.3 suffers from Reflected XSS. `www/admin/stats.php` is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, period_start, period_end, and possibly others.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/83964; https://github.com/revive-adserver/revive-adserver/commit/ecbe822b48ef4ff61c2c6357c0c94199a81946f4; https://hackerone.com/reports/107879