CVE-2019-20364

Ignite Realtime Openfire 4.4.4 is affected by CVE-2019-20364, an XSS vulnerability exploitable via the cacheName parameter in SystemCacheDetails.jsp. The issue originates from Openfire’s web component validating client-side data, allowing potentially crafted input to execute in a user’s browser. ...

CVE-2019-20364

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp...

CVE-2019-20365

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...

CVE-2019-20365

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...

CVE-2019-20365

The connected records confirm a cross-site scripting (XSS) vulnerability in Ignite Realtime Openfire 4.4.4, exploitable via the Users/Group search page. No public details in these documents specify the root cause beyond it being an XSS issue, or provide patch/version remediation. Other sources re...

CVE-2019-20366

CVE-2019-20366: Ignite Realtime Openfire 4.4.4 contains an XSS vulnerability exploitable via isTrustStore to Manage Store Contents. The connected Red Hat, OSV, OSV-GHSA, and CVE listings corroborate an XSS issue affecting Openfire’s management UI. The public documents do not specify root-cause de...

CVE-2019-20366

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...

CVE-2019-20366

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...

CVE-2019-20364: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp...

CVE-2019-20363: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents...

CVE-2019-20365: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...

PT-2020-10400

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.4 Description A cross-site scripting XSS issue was discovered in Ignite Realtime Openfire. The issue is related to the cacheName parameter in the SystemCacheDetails.jsp page. Recommendations For Ignite...

CVE-2019-20366: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...

PT-2020-10402

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.4 Description A cross-site scripting XSS issue was discovered in the software. The issue is related to the isTrustStore function, which is used to manage store contents. Recommendations For Ignite Realtime...

Rethinking cyber learning—consider gamification

As promised, I’m back with a follow-up to my recent post, Rethinking how we learn security, on how we need modernize the learning experience for cybersecurity professionals by gamifying training to make learning fun. Some of you may have attended the recent Microsoft Ignite events in Orlando and...

CVE-2019-18393

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...

CVE-2019-18394

A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests...

CVE-2019-18393

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...

CVE-2019-18394

A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests...

Directory traversal

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...