CVE-2016-9125

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.

• CWE-384
• CWE-384

• https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/93809Permissions Required
• https://hackerone.com/reports/93813Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory
• https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/93809Permissions Required
• https://hackerone.com/reports/93813Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogu…
• CVE-2016-9120Race condition in the ion_ioctl function in drivers/staging/…7.8
• CVE-2016-9121go-jose before 1.0.4 suffers from an invalid curve attack fo…
• CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
• CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9128Revive Adserver before 3.2.3 suffers from reflected XSS. The…
• CVE-2016-9129Revive Adserver before 3.2.3 suffers from Information Exposu…
• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9131named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-…7.5