TI-2023-15609 CVE-2023-32315 · GHSA-gw42-f939-fhvm
Openfire administration console authentication bypass
Priority CRITICAL 96KEV
Openfire is an XMPP server licensed under the Open Source Apache License.
Ignite Realtime
Records7All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Ignite Realtime records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2007-02881 CVE-2007-2975 · GHSA-cxh3-p9rw-hjrr
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does…
Priority LOW 38
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by ac…
TI-2009-00476 CVE-2009-0496 · GHSA-77qm-m87c-hvv8
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2…
Priority LOW 27
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) sear…
TI-2006-06973 CVE-2006-7233 · GHSA-h2w9-42f6-vqjp
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web…
TI-2008-01656 CVE-2008-1728 · GHSA-x337-43mr-gg3h
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated…
Priority LOW 22
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.
TI-2005-04607 CVE-2005-4877 · GHSA-xgh4-3f7c-mx5r
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via Javascript event…
TI-2005-04606 CVE-2005-4876 · GHSA-jpj8-cwj3-qpvw
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2, and possibly other versions before 2.3.0 Beta 2, allows remote attackers to inject arbitr…