Read the docs

igniterealtime

Records45All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

igniterealtime records in CISA KEV
TI-2023-15609 Ignite Realtime Openfire Path Traversal Vulnerability Priority CRITICAL 96KEV 2023-08-24

Components

Products in the NVD configurations · select one to filter the records
Openfire 37 records CRITICAL Smack 3 records LOW Smack Api 1 record LOW Spark 1 record MEDIUM User Import Export 1 record LOW

Records

3 records in Smack · all components

TI-2014-00345 CVE-2014-0364 · GHSA-5xpq-f27x-7pw7

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not…

Priority LOW 32

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06242 Published 2014-04-30 Partial fix CWE-345
TI-2016-08113 CVE-2016-10027 · GHSA-66pq-hqv5-228g

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required…

Priority LOW 30

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client auth…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01513 Published 2017-01-12 Partial fix · 4.1.9 CWE-362
Open these records in search →