Threats tagged 'ghsa-pfrc-phx7-58v8'

A reflected cross-site scripting (XSS) vulnerability exists in the invocation-tag generation interface of Revive Adserver version 6.0.8 and earlier. This vulnerability allows an unauthenticated attacker to execute JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The issue arises when the Direct Selection feature is enabled, allowing attacker-controlled banner identifiers to be included in HTML form fields without proper encoding. Direct Selection is disabled by default. The vulnerability is fixed in version 6.0.9 by applying HTML encoding to banner identifier values in the invocation-option form fields.