Openfire 3.10.2 - Multiple Vulnerabilities

Product: Openfire 3.10.2 Openfire is a real time collaboration RTC server licensed under the Open Source Apache License. It uses the only widely adopted open protocol for instant messaging, XMPP also called Jabber. Vulnerability Type: Unrestricted File Upload Vulnerability Details: Application...

Design/Logic Flaw

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server prior to 3.10 is affected by CVE-2014-3451 due to incorrect handling of self-signed certificates, allowing potential spoofing. The root cause is improper certificate validation for self-signed certificates. The vulnerability is addressed in the 3.10 release (OF-405). No explo...

CVE-2014-3451: Improper Certificate Validation

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

PT-2017-5871

Name of the Vulnerable Software and Affected Versions: OpenFire XMPP Server versions prior to 3.10 Description: The issue allows remote attackers to perform unspecified spoofing attacks due to the acceptance of self-signed certificates. Recommendations: For versions prior to 3.10, update to versi...

Vulnerabilities in ProcessMaker, WebFOCUS, and OpenFire Identified and Patched

Today, Talos is disclosing several vulnerabilities that have been identified by Portcullis in various software products. All four vulnerabilities have been responsibly disclosed to each respective developer in order ensure they are addressed. In order better protect our customers, Talos has also...

Open Fire User Import Export Plugin XML External Entity Injection

Summary An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval of arbitrary files or denial of service. An authenticated attacker can send a crafted web request to trigger this vulnerability...

GLSA-201612-50 : Openfire: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201612-50 Openfire: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Openfire. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could bypass the CSRF protection...

Openfire: Multiple vulnerabilities

Background Openfire formerly Wildfire is a cross-platform real-time collaboration server based on the XMPP Jabber protocol. Description Multiple vulnerabilities have been discovered in Openfire. Please review the CVE identifiers referenced below for details. Impact A remote attacker could bypass...

[ASA-201612-21] openfire: multiple issues

Arch Linux Security Advisory ASA-201612-21 ========================================== Severity: High Date : 2016-12-23 CVE-ID : CVE-2015-6972 CVE-2015-6973 CVE-2015-7707 Package : openfire Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-15 Summary ======= The package...

OpenFire 4.0.1 Cross Site Request Forgery / Cross Site Scripting

Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime community. The actual version of the product is...

OpenFire 3.10.2 4.0.1 - Multiple Vulnerabilities

OpenFire 3.10.2 4.0.1 - Multiple Vulnerabilities Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realtime community. The actual version of the product is...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realti...

Cisco Finesse Desktop and Unified Contact Center Express Privilege Gain Vulnerability

Cisco Finesse Desktop and Unified Contact Center Express Unified CCX are both products of Cisco, Inc.Cisco Finesse Desktop is a suite of software for next-generation agent and desktop management in customer collaboration solutions; Unified CCX is a customer relationship management component of a...

Ignite Realtime Openfire group-summary.jsp Cross-Site Scripting (CVE-2015-6972)

A cross-site scripting vulnerability has been reported in Ignite Realtime Openfire Server. The vulnerability is due to insufficient validation of the "search" parameter within the group-summary.jsp page. By convincing an authenticated user to visit a malicious website, a remote attacker can explo...

CVE-2016-1307

The Openfire server in Cisco Finesse Desktop 10.51 and 11.01 and Unified Contact Center Express 10.61 has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085...