Description
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Remediation
References
Related Vulnerabilities
Ruby on Rails Other Vulnerability (CVE-2021-22904)
WordPress Plugin Safe Redirect Manager SQL Injection (1.7.7)
PostgreSQL Improper Access Control Vulnerability (CVE-2019-10127)
XWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-23618)
PostgreSQL Improper Access Control Vulnerability (CVE-2016-0768)