Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.igniterealtime.openfire:parent

11 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11
Registry
Maven Central

Advisories 11

  • Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.

    Affected: fixed in 4.4.2.

  • Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

    Affected: fixed in 4.4.2.

  • Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.

    Affected: fixed in 4.4.2.

  • An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

    Affected: fixed in 4.5.0.

  • A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to…

    Affected: fixed in 4.5.0-beta.

  • PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home…

    Affected: fixed in 4.5.0-beta.

  • Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

    Affected: fixed in 3.9.2.

  • The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who…

    Affected: fixed in 4.1.7.

  • nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML…

    Affected: fixed in 3.9.2.

  • The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to…

    Affected: fixed in 3.6.4.

  • ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon…

    Affected: fixed in 3.5.0.