CVE-2019-5434

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.

• CWE-502
• CWE-502

• http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
• https://hackerone.com/reports/512076Third Party Advisory
• https://hackerone.com/reports/542670Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2019-001/Vendor Advisory
• http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
• https://hackerone.com/reports/512076Third Party Advisory
• https://hackerone.com/reports/542670Third Party Advisory
• https://www.revive-adserver.com/security/revive-sa-2019-001/Vendor Advisory

Published

May 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5428Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5429Untrusted search path in FileZilla before 3.41.0-rc1 allows …7.8
• CVE-2019-5430In UniFi Video 3.10.0 and prior, due to the lack of CSRF pro…
• CVE-2019-5431This vulnerability was caused by an incomplete fix to CVE-20…5.4
• CVE-2019-5432A specifically malformed MQTT Subscribe packet crashes MQTT …7.5
• CVE-2019-5433A user having access to the UI of a Revive Adserver instance…
• CVE-2019-5435An integer overflow in curl's URL API results in a buffer ov…
• CVE-2019-5436A heap buffer overflow in the TFTP receiving code allows for…7.8
• CVE-2019-5437Information exposure through the directory listing in npm's …
• CVE-2019-5438Path traversal using symlink in npm harp module versions <= …5.3
• CVE-2019-5439A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash…
• CVE-2019-5440Use of cryptographically weak PRNG in the password recovery …