672 matches found
EUVD-2025-29235
Malicious code in bioql PyPI...
CVE-2025-59154
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
Openfire < 5.0.2 / 5.1.0 Identity Spoofing
The remote host is running a version of Openfire that is affected by an identity spoofing vulnerability. Openfireâs SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1...
GHSA-W252-645G-87MP Openfire has potential identity spoofing issue via unsafe CN parsing
Summary Identity spoofing in X.509 client certificate authentication in Openfire allows internal attackers to impersonate other users via crafted certificate subject attributes, due to regex-based extraction of CN from an unescaped, provider-dependent DN string. Analysis Openfire’s SASL EXTERNAL...
CVE-2025-59154
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
CVE-2025-59154
Openfire’s SASL EXTERNAL client TLS authentication uses X509Certificate.getSubjectDN().getName() with a regex to extract CN, producing a provider-dependent string that can fail to escape characters. This allows crafted DN values (e.g., OU="CN=admin,") to masquerade as another user by spoofing the...
CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
CVE-2025-59154
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
PT-2025-37756
Name of the Vulnerable Software and Affected Versions: Openfire versions prior to 5.0.2 Openfire version 5.1.0 Description: Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a flaw in how it extracts user identities from X.509 certificates. The code uses...
Openfire security vulnerabilities
Openfire is an open source real-time collaboration RTC server from Ignite Realtime. A security vulnerability exists in Openfire versions 5.0.2 and 5.1.0 that stems from not properly handling user identities in X.509 certificates, which could allow an attacker to impersonate another user...
CVE-2025-59154: Authentication Bypass by Spoofing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
Exploit for Path Traversal in Igniterealtime Openfire
!Burp Suitehttps://img.shields.io/badge/Burp%20Suite-Pro%20E...
CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOMCACHE component...
CVE-2024-25420
An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component...
CVE-2023-32315
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...
CVE-2020-35199
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS...