Miauzxw

A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values.

An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.

A crafted Cineon file can provide a `numberOfElements` value exceeding the format maximum of eight. The `CineonInput::open()` function uses this unchecked value as a loop bound when filling the `strings[8]` array, causing pointers to be written beyond the stack buffer and into adjacent state. This leads to memory corruption and denial of service.

GitPython fails to properly sanitize arguments passed to several public APIs, allowing for command injection and arbitrary file manipulation. The issue occurs because the software does not enforce safety checks on Git options for certain methods, enabling attackers to inject dangerous flags into the underlying `git` binary calls. Technical details include: - Command Execution: The `Repo.archive()` method forwards `**kwargs` verbatim, and the `git.ls remote()` method allows the `upload pack` keyword argument to be passed without validation. An attacker can use options such as `--exec` or `--upload-pack` to execute arbitrary commands on the host system. - Arbitrary File Overwrite: The `Repo.iter commits()` and `Repo.blame()` methods do not check for leading dashes in the `rev` argument. By passing a value like `--output=<path>`, an attacker can cause Git to open and truncate an arbitrary file on the system. Exploitation requires an application to pass attacker-controlled arguments to these specific methods.