667 matches found
CVE-2019-20364
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp...
CVE-2019-20365
The connected records confirm a cross-site scripting (XSS) vulnerability in Ignite Realtime Openfire 4.4.4, exploitable via the Users/Group search page. No public details in these documents specify the root cause beyond it being an XSS issue, or provide patch/version remediation. Other sources re...
CVE-2019-20365
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...
CVE-2019-20365
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...
CVE-2019-20366
CVE-2019-20366: Ignite Realtime Openfire 4.4.4 contains an XSS vulnerability exploitable via isTrustStore to Manage Store Contents. The connected Red Hat, OSV, OSV-GHSA, and CVE listings corroborate an XSS issue affecting Openfire’s management UI. The public documents do not specify root-cause de...
CVE-2019-20366
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...
CVE-2019-20366
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...
CVE-2019-20363: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents...
PT-2020-10399
Name of the Vulnerable Software and Affected Versions Openfire version 4.4.4 Description A cross-site scripting XSS issue was found, which can be triggered via an alias to Manage Store Contents. Recommendations For Openfire version 4.4.4, at the moment, there is no information about a newer versi...
PT-2020-10401
Name of the Vulnerable Software and Affected Versions Openfire version 4.4.4 Description A cross-site scripting XSS issue was found in the Users/Group search page, specifically when using the search function. Recommendations For version 4.4.4, update to a newer version that contains a fix for thi...
CVE-2019-20364: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp...
CVE-2019-20366: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents...
PT-2020-10402
Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.4 Description A cross-site scripting XSS issue was discovered in the software. The issue is related to the isTrustStore function, which is used to manage store contents. Recommendations For Ignite Realtime...
CVE-2019-20365: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...
PT-2020-10400
Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 4.4.4 Description A cross-site scripting XSS issue was discovered in Ignite Realtime Openfire. The issue is related to the cacheName parameter in the SystemCacheDetails.jsp page. Recommendations For Ignite...
Ignite Realtime Openfire Server-Side Request Forgery Vulnerability
Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A server-side request forgery SSRF vulnerability exists in FaviconServlet.java in Ignite Realtime Openfire 4.4.2 and earlier versions. An attacker can exploit this vulnerability to send...
Ignite Realtime Openfire Directory Traversal Vulnerability
Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A directory traversal vulnerability exists in Ignite Realtime Openfire 4.4.2 and earlier versions. The vulnerability stems from PluginServlet.java in Openfire not ensuring that retrieve...
CVE-2019-18393
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...
