Barcrange

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Low-privileged users can use their Full Name as a vector for a stored Cross-Site Scripting (XSS) attack, which occurs when an application includes untrusted data in a web page without proper validation or escaping. The name is included in system-generated emails, and the content is stored in the details field of the userlog table. An administrator viewing this content through the 'userlog-details.php' endpoint would trigger the execution of malicious JavaScript payloads due to missing output sanitization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Revive Adserver versions prior to 6.0.7 **Description** A missing access control check exists when invoking various modify methods in the XML-RPC API. This allows entities to be reassigned to different parent entities, resulting in inconsistent ownership relationships. This issue is exploitable when combined with other vulnerabilities or third-party API extensions that expose API functionality to low-privileged users. **Recommendations** Update to a version later than 6.0.6 to ensure access control checks are in place to validate access to parent entities in the API modify methods.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A stored Cross-Site Scripting (XSS) issue exists where usernames are used as an attack vector. When an administrator views the audit log details for affected entries, malicious JavaScript payloads embedded in the `username` variable are executed because of missing output sanitization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A validation bypass exists in the XML-RPC API `addUser()` method. This issue allows API users to create usernames that can be used for impersonation or to launch stored Cross-Site Scripting (XSS) attacks, which occur when a malicious script is permanently stored on the target server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.