igniterealtime

Records45All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

igniterealtime records in CISA KEV

TI-2023-15609 Ignite Realtime Openfire Path Traversal Vulnerability CRITICAL 96KEV 2023-08-24

Components

Products in the NVD configurations · select one to filter the records

Openfire 37 records CRITICAL Smack 3 records LOW Smack Api 1 record LOW Spark 1 record MEDIUM User Import Export 1 record LOW

Records

37 records in Openfire · all components

TI-2023-15609 CVE-2023-32315 · GHSA-gw42-f939-fhvm

Openfire administration console authentication bypass

CRITICAL 96KEV

Openfire is an XMPP server licensed under the Open Source Apache License.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.99999 Published 2023-05-26 Fixed in 4.6.8, 4.7.5 CWE-22

TI-2024-16737 CVE-2024-25421 · GHSA-6pwg-gg6j-5crm

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to…

HIGH 82

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0165 Published 2024-03-26 Fixed in 4.8.1 CWE-250

TI-2021-20964 CVE-2021-45967 · GHSA-6669-q2h5-85q9

An issue was discovered in Pascom Cloud Phone System before 7.20.x.

HIGH 82

An issue was discovered in Pascom Cloud Phone System before 7.20.x.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.208 Published 2022-03-18 No fix listed CWE-22

TI-2008-06198 CVE-2008-6508 · GHSA-h2pj-vj4x-w4fp

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in…

HIGH 74

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a ..

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.83664 Published 2009-03-23 No fix listed CWE-22

TI-2024-16736 CVE-2024-25420 · GHSA-5xvc-rwv8-86p7

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate…

HIGH 67

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01431 Published 2024-03-26 Fixed in 4.8.1 CWE-273

TI-2019-13396 CVE-2019-18394 · GHSA-mfjw-x4q4-69p9

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite…

HIGH 66

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.32304 Published 2019-10-24 Fixed in 4.5.0-beta CWE-918

TI-2015-05810 CVE-2015-6973 · GHSA-9293-6mw7-gq5j

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire…

HIGH 66

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted re…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.64818 Published 2015-09-16 No fix listed CWE-352

TI-2014-02192 CVE-2014-2741 · GHSA-j5qh-cp3p-2h87

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly…

MEDIUM 41

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumptio…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03774 Published 2014-04-11 Fixed in 3.9.2 CWE-264

TI-2019-13395 CVE-2019-18393 · GHSA-59h8-h34r-q9cv

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that…

LOW 39

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.13945 Published 2019-10-24 Fixed in 4.5.0-beta CWE-22

TI-2015-06404 CVE-2015-7707 · GHSA-7hqf-jrgw-gx63

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator…

LOW 38

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.06029 Published 2015-10-05 No fix listed CWE-264

TI-2008-06199 CVE-2008-6509 · GHSA-vrj5-ww9h-qh46

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier…

LOW 37

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02011 Published 2009-03-23 No fix listed CWE-89

TI-2014-02781 CVE-2014-3451 · GHSA-2pwf-98xm-hgm2

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote…

LOW 36

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01767 Published 2017-08-18 No fix listed CWE-295

TI-2009-00477 CVE-2009-0497 · GHSA-mpcx-vp9j-q8cq

Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows…

LOW 34

Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08125 Published 2009-02-10 No fix listed CWE-22

TI-2018-08355 CVE-2018-11688 · GHSA-jphj-5g3m-w7x6

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by…

LOW 32

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02372 Published 2018-06-13 Fixed in 3.9.2 CWE-79

TI-2015-05809 CVE-2015-6972 · GHSA-gp6j-6wfw-6chp

Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2…

LOW 31

Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-boo…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07998 Published 2015-09-16 No fix listed CWE-79

TI-2009-01512 CVE-2009-1596 · GHSA-h5m2-8pmw-gmg7

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password…

LOW 31

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.012 Published 2009-05-11 No fix listed CWE-287

TI-2020-15081 CVE-2020-24604 · GHSA-w63g-378w-5j6f

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.

LOW 30

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01169 Published 2020-09-02 No fix listed CWE-79

TI-2019-14605 CVE-2019-20366 · GHSA-m6pr-xcrm-4qqp

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

LOW 30

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01265 Published 2020-01-08 Fixed in 4.5.0 CWE-79

TI-2019-14604 CVE-2019-20365 · GHSA-289r-987x-mj54

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

LOW 30

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01172 Published 2020-01-08 No fix listed CWE-79

TI-2019-14603 CVE-2019-20364 · GHSA-pj77-p8p7-25gv

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

LOW 30

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01172 Published 2020-01-08 No fix listed CWE-79

TI-2019-14602 CVE-2019-20363 · GHSA-694f-cj4r-wxfr

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

LOW 30

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01411 Published 2020-01-08 No fix listed CWE-79

TI-2008-06201 CVE-2008-6511 · GHSA-jvcx-g8c3-q6w7

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote…

LOW 30

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01829 Published 2009-03-23 No fix listed CWE-20

TI-2020-17881 CVE-2020-35200 · GHSA-fwrx-jwp3-4fjp

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

LOW 29

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00913 Published 2020-12-12 No fix listed CWE-79

TI-2020-15080 CVE-2020-24602 · GHSA-jv7f-8q8r-cr3q

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which…

LOW 29

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescriptio…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01012 Published 2020-09-02 No fix listed CWE-79

TI-2019-14748 CVE-2019-20528 · GHSA-wx2w-8pqw-vp4g

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

LOW 29

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00906 Published 2020-03-18 Fixed in 4.4.2 CWE-79

Open these records in search →