Igniterealtime

Openfire

38 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2019-20363

Exploit
  • EPSS 1.09%
  • Published 08.01.2020 17:15:11
  • Last modified 21.11.2024 04:38:18

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

9.8

CVE-2019-18394

  • EPSS 93.88%
  • Published 24.10.2019 11:15:10
  • Last modified 21.11.2024 04:33:11

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

5.3

CVE-2019-18393

  • EPSS 83.85%
  • Published 24.10.2019 11:15:10
  • Last modified 21.11.2024 04:33:11

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

6.1

CVE-2019-15488

  • EPSS 0.22%
  • Published 23.08.2019 13:15:11
  • Last modified 21.11.2024 04:28:51

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

6.1

CVE-2018-11688

Exploit
  • EPSS 3.58%
  • Published 13.06.2018 16:29:01
  • Last modified 21.11.2024 03:43:49

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within...

4.8

CVE-2017-15911

  • EPSS 0.48%
  • Published 26.10.2017 17:29:00
  • Last modified 20.04.2025 01:37:25

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well ...

7.5

CVE-2014-3451

  • EPSS 1.33%
  • Published 18.08.2017 18:29:00
  • Last modified 20.04.2025 01:37:25

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.

6.5

CVE-2015-7707

Exploit
  • EPSS 3.86%
  • Published 05.10.2015 15:59:03
  • Last modified 12.04.2025 10:46:40

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.

6.8

CVE-2015-6973

Exploit
  • EPSS 16.08%
  • Published 16.09.2015 19:59:01
  • Last modified 12.04.2025 10:46:40

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2...

4.3

CVE-2015-6972

Exploit
  • EPSS 4.56%
  • Published 16.09.2015 19:59:00
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName par...