GCVE - cpe:2.3:a:openx:openx:2.8.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openx:openx:2.8.4:*:*:*:*:*:*:*

part: a version: 2.8.4 update: *

Vendor	Openx (`6e3fa5c5-c1c8-5367-b13c-01ea643ae044`)
Product	Openx (`89e83a12-7bfc-5fa4-adfa-f7566c539b34`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2230`	vulnerable	2026-06-08 05:05:27.978658	Details available Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php. Published: 2014-10-23T14:00:00.000Z Updated: 2024-08-06T10:06:00.113Z Open on db.gcve.eu Reference links http://www.tetraph.com/blog/cves/cve-2014-2230-openx-open-redirect-vulnerability-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/97621 http://seclists.org/fulldisclosure/2014/Oct/72 http://packetstormsecurity.com/files/128718/OpenX-2.8.10-Open-Redirect.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-5954`	vulnerable	2026-06-08 05:04:54.826938	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administrators for requests that delete (1) users via admin/agency-user-unlink.php, (2) advertisers via admin/advertiser-delete.php, (3) banners via admin/banner-delete.php, (4) campaigns via admin/campaign-delete.php, (5) channels via admin/channel-delete.php, (6) affiliate websites via admin/affiliate-delete.php, or (7) zones via admin/zone-delete.php. Published: 2014-04-25T10:00:00.000Z Updated: 2024-08-06T17:29:41.164Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2014/May/68 http://packetstormsecurity.com/files/125735 http://seclists.org/fulldisclosure/2014/Mar/270 http://www.securityfocus.com/bid/66251 http://www.securityfocus.com/archive/1/532108/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3515`	vulnerable	2026-06-08 05:04:31.851666	Details available Multiple cross-site scripting (XSS) vulnerabilities in OpenX Source 2.8.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) package parameter to www/admin/plugin-index.php or the (2) group parameter to www/admin/plugin-settings.php. Published: 2013-07-29T21:00:00.000Z Updated: 2024-08-06T16:14:56.078Z Open on db.gcve.eu Reference links https://svn.openx.org/openx/trunk/www/admin/plugin-settings.php https://svn.openx.org/openx/trunk/www/admin/plugin-index.php https://www.htbridge.com/advisory/HTB23155-openx-changeset-82710.diff https://exchange.xforce.ibmcloud.com/vulnerabilities/85411 http://osvdb.org/94774	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3514`	vulnerable	2026-06-08 05:04:31.848083	Details available Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files. Published: 2014-05-14T19:00:00.000Z Updated: 2024-08-06T16:14:56.226Z Open on db.gcve.eu Reference links http://osvdb.org/94778 http://seclists.org/bugtraq/2013/Jul/27 https://www.htbridge.com/advisory/HTB23155	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.