CVE-2009-0497: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the log parameter...

CVE-2009-0496: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 log parameter to a logviewer.jsp and b log.jsp; 2 search parameter to c group-summary.jsp; 3 username parameter to d user-properties.jsp; 4...

Openfire多个跨站脚本和目录遍历漏洞

BUGTRAQ ID: 32935,32937,32938,32939,32940,32943,32944,32945 Openfire（原名为Wildfire）是一个采用Java开发的跨平台开源实时协作（RTC）服务器。...

Openfire 'AuthCheck Filter' Security Bypass Vulnerability

Openfire is prone to a security bypass vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Openfire多个输入验证漏洞

BUGTRAQ ID: 32189 Openfire（原名为Wildfire）是一个采用Java开发的跨平台开源实时协作（RTC）服务器。 Openfire服务器中的多个安全漏洞可能允许攻击者在操作系统上执行任意代码，具体取决于特定的运行时环境。 1 绕过认证 在对openfire管理接口的认证中，Tomcat应用服务器中的过滤器org.jivesoftware.admin.AuthCheckFilter确保仅有通过认证的用户才可以访问管理接口，否则将会被重新定向到登录页面。Openfire中的一个错误可能导致无需管理用户凭据便访问内部功能。...

Ignite Gallery Component for Joomla! 'gallery' Parameter SQLi

The version of the Ignite Gallery component for Joomla! running on the remote host is affected by a SQL injection vulnerability in ignitegallery.php due to improper sanitization of user-supplied input to the 'gallery' parameter before using it to construct database queries. Regardless of the PHP...

Joomla Ignite Gallery 0.8.3 SQL Injection

Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: Valon Kerolli Contact: valonatitshqip.com Site: www.itshqip.com ScriptName: "Joomla" Component: "Ignite Gallery comignitegallery" Version: "0.8.3" Author: "Matt Thomson" Author E-mail:...

Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability ================================================================= Joomla Component Ignite Gallery SQL...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla" Component: "Ignite Gallery comignitegallery" Version: "0.8.3...

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection

Joomla! Component Ignite Gallery 0.8.3 - SQL Injection Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla"...

Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability

No description provided by source. Joomla Component Ignite Gallery SQL Injection Vulnerability Vulnerability found by: H!tm@N Contact: hitmanatkhg-crewdotws Site: www.khg-crew.ws Greetz: boom3rang, KHG, urtan, chs, redc00de - -=Kosova Hackers Group=- ScriptName: "Joomla" Component: "Ignite Galler...

CVE-2008-1728

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service daemon outage by triggering large outgoing queues without reading messages...

CVE-2008-1728

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service daemon outage by triggering large outgoing queues without reading messages...

CVE-2008-1728

CVE-2008-1728 : The Ignite Realtime Openfire 3.4.5 open-source Jabber server is affected via ConnectionManagerImpl.java, where remote authenticated users can trigger large outgoing queues without reading messages, causing a denial of service (daemon outage). The NVD entry lists a base CVSS v2 sco...

Command injection

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

CVE-2007-4590

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

CVE-2007-4590

CVE-2007-4590 affects HP-UX environments where Ignite-UX (C.7.0–C.7.3) and DynRootDisk (DRD) (A.1.0.16.417–A.2.0.0.592) are used. The get_system_info command on HP-UX B.11.11/11.23/11.31 does not inform local users of networking changes it makes, with impact and attack vectors not clearly defined...

CVE-2007-4590

The getsysteminfo command in Ignite-UX C.7.0 through C.7.3, and DynRootDisk DRD A.1.0.16.417 through A.2.0.0.592, on HP-UX B.11.11, B.11.23, and B.11.31 does not inform local users of networking changes made by the command, which has unknown impact and attack vectors...

HP-UX get_system_info privilege escalation

It's possible to change system configuration with getsysteminfo if Ignite-UX or the DynRootDisk DRD are installed...

HPSBUX02249 SSRT071442 rev.1 HP-UX Running the Ignite-UX or the DynRootDisk (DRD) get_system_info Command, Local Unqualified Configuration Change

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01118367 Version: 1 HPSBUX02249 SSRT071442 rev.1 HP-UX Running the Ignite-UX or the DynRootDisk DRD getsysteminfo Command, Local Unqualified Configuration Change NOTICE: The information in this...