559 matches found
CVE-2014-2741
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
Design/Logic Flaw
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
CVE-2014-2741
nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...
CVE-2014-2741
Openfire before 3.9.2 is affected by a denial-of-service due to improper restriction in nio/XMLLightweightParser.java when processing compressed XML in XMPP streams (xmppbomb). Exploitation can exhaust resources on the server via crafted XMPP traffic. The issue is fixed in Openfire 3.9.2 and late...
Openfire 3.8.2 server new admin password/add new admin Exploit
This expoit use multiple vulnerabilites in Openfire. Openfire admin must visit exploit link. Attacker can create new admin or change admin password. Openfire is a real time collaboration RTC server licensed under the Open Source Apache License. It uses the only widely adopted open protocol for...
Ncentral 8.x Insecure Access / Unsalted Passwords / CSRF Vulnerabilities
Ncentral versions 8.0.x through 8.2.0-1152 suffer from insecure SOAP access that leads to an unprivileged SSH session, poor trust based authentication leading to database compromise, plain text password storage, cross site request forgery, and other vulnerabilities. RA001: Multiple vulnerabilitie...
Openfire Admin Console Authentication Bypass
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex/zip' class Metasploit3...
Openfire Server 3.6.0a - Admin Console Authentication Bypass (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'rex/zip' class Metasploit3...
Openfire Admin Console Authentication Bypass
This module exploits an authentication bypass vulnerability in the administration console of Openfire servers. By using this vulnerability it is possible to upload/execute a malicious Openfire plugin on the server and execute arbitrary Java code. This module has been tested against Openfire 3.6.0...
FastPath Webchat | Multiple Cross Site Scripting Vulnerabilities
OVERVIEW Fastpath WebChat is vulnerable to Cross Site Scripting. 2. BACKGROUND Fastpath WebChat is part of the Fastpath product. It provides a way for users to begin chatting with support agents using Fastpath. Fastpath is a plugin of OpenFire, a real time collaboration RTC server for instant...
OpenFire crossite scripting
Multiple crossite scriptinf possibilities...
Multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section
Hi, This is regarding multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section. The following is the disclosure document: Title: Multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section ------------------------------------------------------------------------...
Openfire 3.6.4 Multiple CSRF Vulnerabilities
Exploit for jsp platform in category web applications Project: Openfire Severity: High Versions: 3.6.4 other versions may be affected Exploit type: Multiple CSRF Fixes Available: None ------------------------------------------------------------------------...
Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section
Hi, This is regarding multiple CSRF Cross Site Request Forgery Vulnerabilities in Openfire 3.6.4 Administrative Section. The following is the disclosure document: Title: Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section...
Openfire 3.6.4 - Multiple Cross-Site Request Forgery Vulnerabilities
Title: Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section ------------------------------------------------------------------------ ------------------------------------------------------------------------ -- Project: Openfire Severity: High Versions: 3.6.4 other versions may be...
Openfire 3.6.4 Cross Site Request Forgery
Hi, This is regarding multiple CSRF Cross Site Request Forgery Vulnerabilities in Openfire 3.6.4 Administrative Section. The following is the disclosure document: Title: Multiple CSRF Vulnerabilities in Openfire 3.6.4 Administrative Section...
Openfire 3.6.4 Cross Site Scripting
Hi, This is regarding multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section. The following is the disclosure document: Title: Multiple XSS Vulnerabilities in Openfire 3.6.4 Administrative Section ------------------------------------------------------------------------...
Openfire 3.6.4 - Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/45682/info Openfire is prone to multiple cross-site-scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...
Openfire 3.6.4 - Multiple Cross-Site Scripting Vulnerabilities
Openfire 3.6.4 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/45682/info Openfire is prone to multiple cross-site-scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues ...
Openfire Admin Console login.jsp XSS
The Openfire admin console running on the remote host has a cross-site scripting vulnerability. Input to the 'username' parameter of 'login.jsp' is not properly sanitized. An attacker could exploit this by tricking a user into making a specially crafted POST request, resulting in arbitrary script...