Threats tagged 'ghsa-g646-v7w5-2fhc'

Revive Adserver versions 6.0.8 and earlier contain a stored cross-site scripting (XSS) vulnerability in the report date-selection controls. An unauthenticated attacker can craft a malicious report URL that, after the victim reauthenticates, executes JavaScript in the victim's browser. This occurs because an attacker-controlled period_preset value is stored in the victim's session and inserted into JavaScript without proper encoding. The vulnerability is fixed in version 6.0.9 by applying appropriate JSON encoding to date-selection values.