CVE

Id
95947  
CVE No.
CVE-2016-9127  
Status
Candidate  
Description
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.  
Phase
Assigned (20161031)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
799638 95947 CVE-2016-9127 MISC:https://github.com/revive-adserver/revive-adserver/commit/3aaebcc765797d2c684e031f2836e0a69d6b7bc2  View
799639 95947 CVE-2016-9127 MISC:https://hackerone.com/reports/99452  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
5408 JVNDB-2016-006181 Tatsuya Kinoshita w3m フォークにおけるサービス運用妨害 (DoS) の脆弱性 Tatsuya Kinoshita w3m フォークには、サービス運用妨害 (セグメンテーション違反およびクラッシュ) 状態にされる脆弱性が存在します。 CVE-2016-9440 95947 4.3 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-006181.html  View