Cross site scripting

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS...

Cross site scripting

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS...

CVE-2020-35199

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS...

CVE-2020-35199

Openfire 4.6.0 from Ignite Realtime contains a Stored XSS in create-bookmark.jsp with the groupchatJID parameter. Descriptions across sources indicate exploitation could enable credential theft (stored XSS risk). No official patch/version is specified in the provided documents. Some advisories su...

CVE-2020-35200

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS...

CVE-2020-35200

CVE-2020-35200 affects Ignite Realtime Openfire 4.6.0, specifically the plugin file plugins/clientcontrol/spark-form.jsp, with a Reflective XSS flaw. The connected sources confirm the vulnerability in this exact component and version; exploitation status or in-the-wild details are not provided. M...

CVE-2020-35202

CVE-2020-35202 affects Ignite Realtime Openfire 4.6.0, with a Stored XSS vulnerability in the db-access.jsp file of the dbaccess plugin. The issue is triggered through SQL handling in that component, enabling script injection under the described conditions. Connected sources corroborate Openfire ...

CVE-2020-35201

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS...

CVE-2020-35201

CVE-2020-35201 affects Ignite Realtime Openfire 4.6.0, with a Stored XSS in the create-bookmark.jsp page affecting users. The connected documents confirm the affected product/version and the vulnerability class; no concrete patch/version fix is stated. An exploit-db entry is linked, suggesting ex...

PT-2020-17289 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Ignite Realtime Openfire version 4.6.0 Description: The issue is related to a Reflective XSS in the plugins/clientcontrol/spark-form.jsp file. Recommendations: For Ignite Realtime Openfire version 4.6.0, consider restricting access to the...

CVE-2020-35127

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS...

CVE-2020-35127

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS...

Cross site scripting

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS...

CVE-2020-35127

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS...

CVE-2020-35127

CVE-2020-35127 affects Ignite Realtime Openfire 4.6.0 with a stored XSS in the bookmarks plugin, specifically in create-bookmark.jsp. The vulnerability arises from the bookmarks/create-bookmark.jsp handling potentially unsanitized input, enabling an attacker to inject scripts that may execute in ...

CVE-2020-24604

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescriptio...

CVE-2020-24601

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page...

CVE-2020-24601

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page...

CVE-2020-24604

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescriptio...

CVE-2020-24602

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...