Code injection

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707

Openfire 3.10.2 is affected by CVE-2015-7707, where remote authenticated users can gain administrator access via the isadmin parameter in user-edit-form.jsp. This is part of a set of linked issues (CVE-2015-6972/6973/7707) that also include CSRF and XSS vulnerabilities, enabling privilege escalat...

CVE-2015-7707

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

CVE-2015-7707: Undefined Security Weakness

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp...

PT-2015-7588

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire version 3.10.2 Description The issue allows remote authenticated users to gain administrator access. This is achieved by exploiting the isadmin parameter in the "user-edit-form.jsp" endpoint. Recommendations For Ignite...

Gentoo Security Advisory GLSA 201406-35

Gentoo Linux Local Security Checks GLSA 201406-35 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Multiple Cross-Site Request Forgery Vulnerabilities in Ignite Realtime Openfire

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

Multiple Cross-Site Scripting Vulnerabilities in Ignite Realtime Openfire

Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...

CVE-2015-6973

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

CVE-2015-6973

Openfire (Ignite Realtime) 3.10.2 is affected by CVE-2015-6973 (and related CVEs) due to insufficient CSRF protections. Multiple CSRF vulnerabilities allow remote attackers to hijack administrator sessions by issuing crafted requests to JSPs such as user-password.jsp, user-create.jsp, server-prop...

CVE-2015-6973

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

CVE-2015-6973

Multiple cross-site request forgery CSRF vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that 1 change a password via a crafted request to user-password.jsp, 2 add users via a crafted request to user-create.jsp,...

CVE-2015-6972

CVE-2015-6972 relates to multiple XSS vulnerabilities in Ignite Realtime Openfire 3.10.2. The issues arise from insufficient validation/filtering of inputs in several pages: group-summary.jsp (search parameter), plugins/clientcontrol/create-bookmark.jsp (groupchatName and urlName), and server-ses...

CVE-2015-6972

Multiple cross-site scripting XSS vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the 1 groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the 2 urlName parameter to plugins/clientcontrol/create-bookmark.jsp;...

PT-2015-7430

Name of the Vulnerable Software and Affected Versions Openfire version 3.10.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the groupchatName parameter, urlName parameter, hostname parameter, or the search parameter in vario...