https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 19:39:50 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-68486 <p>An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency&#39;s campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign&#39;s name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.</p> <p>An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency&#39;s campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign&#39;s name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.</p> https://db.gcve.eu/vuln/fkie_cve-2026-68486 https://db.gcve.eu/vuln/gcve-1988-2026-0565 <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.8 Versions not affected: &gt;= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------</p> <p>Description -----------</p> <p>Resolution ----------</p> <p>References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html</p> <p>========================================================…</p> <p><strong>Affected:</strong> unknown Revive Adserver Vulnerabilities</p> <p>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: &lt;= 6.0.8 Versions not affected: &gt;= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================</p> <p>======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------</p> <p>Description -----------</p> <p>Resolution ----------</p> <p>References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html</p> <p>========================================================…</p> https://db.gcve.eu/vuln/gcve-1988-2026-0565 https://db.gcve.eu/vuln/ghsa-q8v9-5h9r-rjp3 <p>An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency&#39;s campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign&#39;s name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.</p> <p>An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency&#39;s campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign&#39;s name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.</p> https://db.gcve.eu/vuln/ghsa-q8v9-5h9r-rjp3