620 matches found
CVE-2019-18393
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...
CVE-2019-18393
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. Recent assessments: ericalexanderorg at August 04, 2020 4:44pm UTC reported: More detail: Stupid easy GET...
CVE-2019-18393: Improper Limitation of a Pathname to a Restricted Directory
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability...
CVE-2019-18394
A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. Recent assessments: ericalexanderorg at August 04, 2020 4:42pm UTC reported: More detail Stupid easy SSRF...
CVE-2019-18394: Server-Side Request Forgery (SSRF)
A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests...
Openfire 4.4.1 Cross Site Scripting
Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1 Affected Software: Openfire Affected Versions: 4.4.1 Vendor Homepage: https://www.igniterealtime.org/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fix...
PT-2019-5531 · Ignite Realtime · Openfire
Name of the Vulnerable Software and Affected Versions: Openfire versions through 4.4.2 Description: A Server Side Request Forgery SSRF vulnerability in FaviconServlet.java allows attackers to send arbitrary HTTP GET requests. The issue is related to insufficient validation of incoming requests,...
Cross-site Scripting in Ignite Realtime Openfire
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
GHSA-5QFV-RR79-CHX5 Cross-site Scripting in Ignite Realtime Openfire
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2019-29164)
Ignite Realtime Openfire is the Ignite Realtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open source real-time collaboration RTC server , it can build a highly efficient instant messaging server , and supports tens of...
Cross-site Scripting (XSS)
Openfire Core XMPP Server is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the parameters in LDAP setup test, allowing an attacker to inject arbitrary script through it...
CVE-2019-15488
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
CVE-2019-15488
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
Cross site scripting
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
CVE-2019-15488
CVE-2019-15488 affects Ignite Realtime Openfire before 4.4.1, where the LDAP setup test endpoint processes input in a way that allows a reflected XSS payload. The issue is described as a reflected XSS via the LDAP setup test in multiple sources (Openfire, Red Hat advisory, OSV, etc.). No explicit...
CVE-2019-15488
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
CVE-2019-15488: Improper Neutralization of Input During Web Page Generation
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test...
Openfire < 3.9.2 Reflected XSS Vulnerability - Active Check
Openfire is prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2018-14347)
Ignite Realtime Openfire formerly known as Wildfire is the IgniteRealtime community of a Java development and based on XMPP formerly known as Jabber, Instant Messaging Protocol cross-platform open-source real-time collaboration RTC server , it can build a high-efficiency instant messaging servers...
CVE-2018-11688
Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...