CVE-2016-9124

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.

• CWE-307
• CWE-287

• https://github.com/revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/96115Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory
• https://github.com/revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/96115Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9118Heap Buffer Overflow (WRITE of size 4) in function pnmtoimag…
• CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogu…
• CVE-2016-9120Race condition in the ion_ioctl function in drivers/staging/…7.8
• CVE-2016-9121go-jose before 1.0.4 suffers from an invalid curve attack fo…
• CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
• CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9128Revive Adserver before 3.2.3 suffers from reflected XSS. The…
• CVE-2016-9129Revive Adserver before 3.2.3 suffers from Information Exposu…
• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …