332 matches found
CVE-2009-1595
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwdchange action...
CVE-2009-1596
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password aka canChangePassword console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwdchange IQ packet...
CVE-2009-1595
The CVE-2009-1595 issue affects Ignite Realtime Openfire, where the jabber:iq:auth implementation in IQAuthHandler.java on versions before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts by modifying the username element in a passwd_change action. This enable...
CVE-2009-1595
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwdchange action...
CVE-2009-1596
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password aka canChangePassword console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwdchange IQ packet...
CVE-2009-1596
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password aka canChangePassword console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwdchange IQ packet...
CVE-2009-1595
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwdchange action...
CVE-2009-1596
CVE-2009-1596 affects Ignite Realtime Openfire prior to 3.6.5. The register.password (canChangePassword) console setting is not properly enforced, allowing remote authenticated users to bypass the intended policy and change their own passwords via a passwd_change IQ packet. The vulnerability enab...
CVE-2009-1596: Improper Authentication
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password aka canChangePassword console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwdchange IQ packet...
CVE-2009-1595: Improper Authentication
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwdchange action...
Directory traversal
Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the log parameter...
CVE-2009-0497
Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the log parameter...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 log parameter to a logviewer.jsp and b log.jsp; 2 search parameter to c group-summary.jsp; 3 username parameter to d user-properties.jsp; 4...
CVE-2009-0497
CVE-2009-0497 is an Openfire vulnerability (Openfire 3.6.2 and affected builds) where the log.jsp component fails to validate the log parameter, allowing a remote attacker to perform a directory traversal (via ..) and read arbitrary files on the server. The issue is caused by improper input valid...
CVE-2009-0496
Openfire (Ignite Realtime) versions prior to 3.6.3 are affected by multiple input-validation vulnerabilities (CVE-2009-0496 among others) in several .jsp pages, which could allow remote attackers to inject XSS and potentially upload a malicious plugin to achieve arbitrary code execution. The Gent...
CVE-2009-0496
Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 log parameter to a logviewer.jsp and b log.jsp; 2 search parameter to c group-summary.jsp; 3 username parameter to d user-properties.jsp; 4...
CVE-2009-0497
Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the log parameter...
CVE-2009-0496
Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 log parameter to a logviewer.jsp and b log.jsp; 2 search parameter to c group-summary.jsp; 3 username parameter to d user-properties.jsp; 4...
CVE-2009-0496: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 log parameter to a logviewer.jsp and b log.jsp; 2 search parameter to c group-summary.jsp; 3 username parameter to d user-properties.jsp; 4...
CVE-2009-0497: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the log parameter...