CVE-2015-6973

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

CVE-2015-6973

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

CVE-2015-6973

Openfire (Ignite Realtime) 3.10.2 is affected by CVE-2015-6973 (and related CVEs) due to insufficient CSRF protections. Multiple CSRF vulnerabilities allow remote attackers to hijack administrator sessions by issuing crafted requests to JSPs such as user-password.jsp, user-create.jsp, server-prop...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

CVE-2015-6972

CVE-2015-6972 relates to multiple XSS vulnerabilities in Ignite Realtime Openfire 3.10.2. The issues arise from insufficient validation/filtering of inputs in several pages: group-summary.jsp (search parameter), plugins/clientcontrol/create-bookmark.jsp (groupchatName and urlName), and server-ses...

Design/Logic Flaw

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof...

CVE-2014-5075

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof...

CVE-2014-5075

CVE-2014-5075 : The Ignite Realtime Smack XMPP API (4.x before 4.0.2; 3.x and 2.x when a custom SSLContext is used) does not verify that the SSL certificate’s CN or SAN matches the server hostname, enabling man-in-the-middle with an arbitrary valid certificate. This is a hostname verification fla...

CVE-2014-6951

The OneFile Ignite aka uk.co.onefile.ignite application 1.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Buffer overflow

The OneFile Ignite aka uk.co.onefile.ignite application 1.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6951

The OneFile Ignite aka uk.co.onefile.ignite application 1.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6951

The OneFile Ignite (uk.co.onefile.ignite) Android app, version 1.19, does not verify X.509 certificates from SSL servers, per CVE-2014-6951. This leads to MITM possible to spoof servers and exfiltrate data. Public records (NVD, CVE listings) confirm the vulnerability and its impact (partial confi...

Joomla Component Ignite Gallery 0.8.3 - SQL Injection Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import re class TestPOCPOCBase: vulID = '65822' ssvid version = '1.0' author = 'kikay' vulDate = '2009-02-19' createDate ...

CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...

CVE-2014-0363

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

Design/Logic Flaw

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

Design/Logic Flaw

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute...