Authentication Bypass

org.igniterealtime.openfire:xmppserver is vulnerable to authentication bypass. A remote unauthenticated attacker is able to access restricted pages in the Openfire Admin Console designated for administrative users due to a path traversal in the unauthenticated Openfire Setup Environment...

CVE-2021-45968: Server-Side Request Forgery (SSRF)

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x and in other products. An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394...

Directory Traversal

xmppserver is vulnerable to directory traversal. Lack of validation of file names in the handleOtherRequest function in PluginServlet.java allows an attacker to retrieve local system files...