CVE-2024-25421

<= 4.9.0

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE compone

9.8CRITICAL

CVE-2024-25420

<= 4.9.0

An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs sys

7.2HIGH

CVE-2023-32315

>= 3.10.0 and < 4.6.8

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based applicati

8.6HIGH

CVE-2021-45967

< 4.5.0

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat serve

9.8CRITICAL

CVE-2020-35202

all versions

Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.

5.4MEDIUM

CVE-2020-35201

all versions

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.

5.4MEDIUM

CVE-2020-35200

all versions

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

6.1MEDIUM

CVE-2020-35199

all versions

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.

5.4MEDIUM

CVE-2020-35127

all versions

Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.

5.4MEDIUM

CVE-2020-24604

all versions

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attack

6.1MEDIUM

CVE-2020-24602

all versions

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary ma

6.1MEDIUM

CVE-2020-24601

all versions

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via t

6.1MEDIUM

CVE-2019-20526

all versions

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.

6.1MEDIUM

CVE-2019-20525

all versions

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

6.1MEDIUM

CVE-2019-20527

all versions

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.

6.1MEDIUM

CVE-2019-20528

all versions

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

6.1MEDIUM

CVE-2019-20366

all versions

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

6.1MEDIUM

CVE-2019-20365

all versions

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

6.1MEDIUM

CVE-2019-20364

all versions

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

6.1MEDIUM

CVE-2019-20363

all versions

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

6.1MEDIUM

CVE-2019-18394

<= 4.4.2

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attacke

9.8CRITICAL

CVE-2019-18393

<= 4.4.2

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire h

5.3MEDIUM

CVE-2019-15488

< 4.4.1

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

6.1MEDIUM

CVE-2018-11688

all versions

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

6.1MEDIUM

CVE-2017-15911

<= 4.1.6

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victim

4.8MEDIUM

CVE-2014-3451

<= 3.9.3

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing a

7.5HIGH

CVE-2015-7707

all versions

Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-e

CVE-2015-6973

all versions

Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the

CVE-2015-6972

all versions

Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary

CVE-2014-2741

<= 3.9.1

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML

CVE-2009-1596

< 3.6.5

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configurat

6.5MEDIUM

CVE-2009-1595

<= 3.6.3

The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users

CVE-2008-6511

<= 3.6.0a

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web

CVE-2008-6510

<= 3.6.0a

Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers

CVE-2008-6509

<= 3.6.0a

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrar

CVE-2008-6508

<= 3.6.0a

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attack

CVE-2009-0497

all versions

Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via

CVE-2009-0496

all versions

Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary w

CVE-2008-1728

all versions

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemo

CVE-2007-2975

<= 3.3.0

The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in

CVE-2006-7233

<= 3.5.2

Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0,

CVE-2005-4877

all versions

Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0

CVE-2005-4876

all versions

Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.2.2,