Skip to content
OpenAdvisories

Package · Maven

org.igniterealtime.openfire:parent

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Medium 6.1
    CVE-2019-20526

    Ignite Realtime Openfire allows Cross-site Scripting

    Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.

    org.igniterealtime.openfire:parent Maven
  • Medium 6.1
    CVE-2019-20525

    Ignite Realtime Openfire allows Cross-site Scripting

    Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

    org.igniterealtime.openfire:parent Maven
  • Medium 6.1
    CVE-2019-20527

    Ignite Realtime Openfire allows Cross-site Scripting

    Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.

    org.igniterealtime.openfire:parent Maven
  • Medium —
    CVE-2019-20366

    XSS in Ignite Realtime Openfire via isTrustStore

    An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

    org.igniterealtime.openfire:parent Maven
  • Critical 9.8
    CVE-2019-18394 Public exploit Scanner template EPSS 32%

    Ignite Realtime Openfire vulnerable to Server Side Request Forgery

    A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

    org.igniterealtime.openfire:parent Maven
  • Medium 5.3
    CVE-2019-18393 Scanner template EPSS 14%

    Ignite Realtime Openfire directory traversal vulnerability

    PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

    org.igniterealtime.openfire:parent Maven
  • Medium 6.1
    CVE-2018-11688

    Ignite Realtime Openfire vulnerable to cross-site scripting

    Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the secu…

    org.igniterealtime.openfire:parent Maven
  • Medium 4.8
    CVE-2017-15911

    Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console

    The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the po…

    org.igniterealtime.openfire:parent Maven
  • High —
    CVE-2014-2741

    Ignite Realtime Openfire vulnerable to XMPPbomb attack

    nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "x…

    org.igniterealtime.openfire:parent Maven
  • Medium —
    CVE-2009-1595 Public exploit

    Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts

    The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.

    org.igniterealtime.openfire:parent Maven
  • Medium —
    CVE-2008-1728

    Ignite Realtime Openfire allows remote authenticated users to cause a denial of service

    ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.

    org.igniterealtime.openfire:parent org.igniterealtime.openfire:openfire Maven