Johan Caluwe

**Nome do software vulnerável e versões afetadas** Versões do PMB 7.3.1 a 7.3.18 Versões do PMB 7.4.1 a 7.4.9 Versões do PMB 7.5.1 a 7.5.6-2 **Descrição** O problema está relacionado à desserialização de dados não confiáveis, o que pode levar à inclusão remota de código. Isso permite que um invasor remoto execute código arbitrário. **Recomendações** Para as versões do PMB 7.3.1 a 7.3.18, atualize para a versão 7.3.18 ou posterior. Para as versões 7.4.1 a 7.4.9 do PMB, atualize para a versão 7.4.9 ou posterior. Para as versões 7.5.1 a 7.5.6-2 do PMB, atualize para a versão 7.5.6-2 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Revive Adserver versions prior to 3.2.3 **Description** The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for external banners when displayed on most banner-related pages. **Recommendations** For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the banner image URL for external banners to minimize the risk of exploitation. Avoid using the banner image URL feature in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Revive Adserver versions prior to 3.2.3 **Description** The issue affects the "www/admin/stats.php" endpoint, which is vulnerable to reflected XSS attacks. This is due to multiple parameters not being properly sanitised or escaped when displayed, including `setPerPage`, `pageId`, `bannerid`, `period start`, and `period end`. **Recommendations** For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "www/admin/stats.php" endpoint until the update is applied. Avoid using the vulnerable parameters in this endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Revive Adserver versions prior to 3.2.3 **Description** The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the website name not being properly escaped when displayed in the campaign-zone.php script. **Recommendations** For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the campaign-zone.php script to minimize the risk of exploitation.