Priority MEDIUM 56
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.0028 · Published 2026-01-26 · No fix listed CWE-79
Priority LOW 26
Openfire is an XMPP server licensed under the Open Source Apache License.
CVSS 3.1MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00234 · Published 2025-09-15 · Fixed in 5.0.2 CWE-290
Priority HIGH 82
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0165 · Published 2024-03-26 · Fixed in 4.8.1 CWE-250
Priority HIGH 67
An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01431 · Published 2024-03-26 · Fixed in 4.8.1 CWE-273
Priority CRITICAL 96KEV
Openfire is an XMPP server licensed under the Open Source Apache License.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-05-26 · Fixed in 4.6.8, 4.7.5 CWE-22
Priority HIGH 82
An issue was discovered in Pascom Cloud Phone System before 7.20.x.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.208 · Published 2022-03-18 · No fix listed CWE-22
Priority LOW 25
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00617 · Published 2020-12-12 · No fix listed CWE-79
Priority LOW 29
Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00913 · Published 2020-12-12 · No fix listed CWE-79
Priority LOW 26
Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0074 · Published 2020-12-12 · No fix listed CWE-79
Priority LOW 26
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0074 · Published 2020-12-12 · No fix listed CWE-79
Priority LOW 25
Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00573 · Published 2020-12-11 · No fix listed CWE-79
Priority LOW 28
In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0062 · Published 2020-09-02 · No fix listed CWE-79
Priority LOW 30
A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01169 · Published 2020-09-02 · No fix listed CWE-79
Priority LOW 29
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescriptio…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01012 · Published 2020-09-02 · No fix listed CWE-79
Priority MEDIUM 42
An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0174 · Published 2020-05-12 · No fix listed CWE-200
Priority LOW 29
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00906 · Published 2020-03-19 · Fixed in 4.4.2 CWE-79
Priority LOW 29
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00906 · Published 2020-03-19 · Fixed in 4.4.2 CWE-79
Priority LOW 29
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00906 · Published 2020-03-19 · Fixed in 4.4.2 CWE-79
Priority LOW 29
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00906 · Published 2020-03-18 · Fixed in 4.4.2 CWE-79
Priority LOW 30
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01411 · Published 2020-01-08 · No fix listed CWE-79
Priority LOW 30
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01172 · Published 2020-01-08 · No fix listed CWE-79
Priority LOW 30
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01172 · Published 2020-01-08 · No fix listed CWE-79
Priority LOW 30
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01265 · Published 2020-01-08 · Fixed in 4.5.0 CWE-79
Priority HIGH 66
A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.32304 · Published 2019-10-24 · Fixed in 4.5.0-beta CWE-918
Priority LOW 39
PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.13945 · Published 2019-10-24 · Fixed in 4.5.0-beta CWE-22
Load more
THREATIST.IORead the docs