Revive Adserver versions 3.2.4 and below suffers from reflected file download, cross site scripting, and special element injection.