Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/.

Remediation

References

CVE-2014-9407

Related Vulnerabilities

WordPress Plugin Migration, Backup, Staging-WPvivid Cross-Site Scripting (0.9.55)

MediaWiki CVE-2019-12467 Vulnerability (CVE-2019-12467)

PHP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2015-8878)

WordPress Plugin Starfish Review Generation & Marketing for WordPress Security Bypass (2.0.0)

Rukovoditel Cross-site Scripting (XSS) Vulnerability (CVE-2019-7541)

Severity

Medium

Classification

CVE-2014-9407 CWE-352

Tags

Missing Update Known Vulnerabilities