CVE-2015-7370

Multiple cross-site scripting (XSS) vulnerabilities in open-flash-chart.swf in Open Flash Chart 2, as used in the VideoAds plugin in Revive Adserver before 3.2.2 and CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026, allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data-file parameter.

• CWE-79

• http://packetstormsecurity.com/files/133893/Revive-Adserver-3.2.1-CSRF-XSS-Local-File-Inclusion.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2015/Oct/32
• http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx
• http://www.revive-adserver.com/security/revive-sa-2015-001Vendor Advisory
• http://www.securityfocus.com/archive/1/536633/100/0/threaded
• http://www.securityfocus.com/bid/91497
• http://www.securitytracker.com/id/1036193Third Party Advisory
• http://packetstormsecurity.com/files/133893/Revive-Adserver-3.2.1-CSRF-XSS-Local-File-Inclusion.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2015/Oct/32
• http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160627-01-security-notice-for-release-automation.aspx
• http://www.revive-adserver.com/security/revive-sa-2015-001Vendor Advisory
• http://www.securityfocus.com/archive/1/536633/100/0/threaded
• http://www.securityfocus.com/bid/91497
• http://www.securitytracker.com/id/1036193Third Party Advisory

Published

Oct 14, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7364The HTML_Quickform library, as used in Revive Adserver befor…
• CVE-2015-7365Cross-site scripting (XSS) vulnerability in the plugin upgra…
• CVE-2015-7366Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-7367Revive Adserver before 3.2.2 allows remote attackers to perf…
• CVE-2015-7368Revive Adserver before 3.2.2 does not send the appropriate C…
• CVE-2015-7369The default Flash cross-domain policy (crossdomain.xml) in R…
• CVE-2015-7371Revive Adserver before 3.2.2 does not restrict access to run…
• CVE-2015-7372Directory traversal vulnerability in delivery-dev/al.php in …
• CVE-2015-7373Cross-site scripting (XSS) vulnerability in the "magic-macro…
• CVE-2015-7374The Remote Agent component in Schneider Electric InduSoft We…
• CVE-2015-7375Schneider Electric InduSoft Web Studio before 8.0 allows rem…
• CVE-2015-7377Cross-site scripting (XSS) vulnerability in pie-register/pie…