Threats tagged 'ghsa-887v-xrgp-88mv'

Revive Adserver versions 6.0.8 and earlier contain a reflected cross-site scripting (XSS) vulnerability in the iframe invocation options. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The vulnerability arises because the frame_width and frame_height parameters are included in HTML attributes without proper encoding. The issue is resolved in version 6.0.9 by applying HTML encoding to these parameters in the invocation-option form fields.