CVE-2016-9129

Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.

• CWE-203
• CWE-200

• https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/98612Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory
• https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/98612Permissions Required
• https://www.revive-adserver.com/security/revive-sa-2016-001/Patch, Vendor Advisory

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
• CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
• CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…
• CVE-2016-9128Revive Adserver before 3.2.3 suffers from reflected XSS. The…
• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9131named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-…7.5
• CVE-2016-9132In Botan 1.8.0 through 1.11.33, when decoding BER data an in…
• CVE-2016-9134Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…
• CVE-2016-9135Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…
• CVE-2016-9136Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83…7.5