Threats tagged 'ghsa-qc26-69mr-77q8'

A reflected cross-site scripting (XSS) vulnerability exists in the conversion-statistics pages of Revive Adserver version 6.0.8 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The root cause is an incorrect ownership check that validates the advertiser identifier instead of the website identifier, leading to malicious input being rendered without proper encoding. Additionally, the hour parameter is improperly handled. The vulnerability is fixed in version 6.0.9 by correcting the identifier validation and normalizing the hour parameter.