CVSS: 4.3EPSS: 89%CPEs: 1EXPL: 7CVE-2009-0496 – Openfire 3.6.2 - 'group-summary.jsp' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-0496
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfig_roomname and (11) roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp. NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin. Múltiples vulnerabilidades de ejecución de secuencias de comandos cruzados en Ignite Realtime Openfire v3.6.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de los parámetros (1) "log" a (a) logviewer.jsp y (b) log.jsp; (2) "search" a (c) group-summary.jsp; (3) "username" a (d) user-properties.jsp; (4) "logDir", (5) "maxTotalSize", (6) "maxFileSize", (7) "maxDays", y (8) "logTimeout" a (e) audit-policy.jsp; (9) "propName" a (f) server-properties.jsp; y (10) "roomconfig_roomname" y (11) "roomconfig_roomdesc" a (g) muc-room-edit-form.jsp. • https://www.exploit-db.com/exploits/32677 https://www.exploit-db.com/exploits/32679 https://www.exploit-db.com/exploits/32678 http://secunia.com/advisories/33452 http://www.coresecurity.com/content/openfire-multiple-vulnerabilities http://www.igniterealtime.org/issues/browse/JM-1506 http://www.securityfocus.com/archive/1/499880/100/0/threaded http://www.securityfocus.com/bid/32935 http://www.securityfocus.com/bid/32937 http://www.securityfocus.com/bid/32938 http://www.secu • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 1%CPEs: 1EXPL: 0CVE-2008-1728
https://notcve.org/view.php?id=CVE-2008-1728
ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages. ConnectionManagerImpl.java en Ignite Realtime Openfire 3.4.5 permite a usuarios remotos autenticados provocar una denegación de servicio (interrupción del demonio) desencadenando grandes colas de salida sin leer los mensajes. • http://secunia.com/advisories/29751 http://secunia.com/advisories/29901 http://security.gentoo.org/glsa/glsa-200804-26.xml http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html http://www.igniterealtime.org/fisheye/changelog/svn-org?cs=10031 http://www.igniterealtime.org/issues/browse/JM-1289 http://www.openwall.com/lists/oss-security/2008/04/10/7 http://www.securityfocus.com/bid/28722 http://www.vupen.com/english/advisories/2008/1188/references https:/&#x • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 0CVE-2007-2975
https://notcve.org/view.php?id=CVE-2007-2975
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader. La consola de administración de Ignite Realtime Openfire versiones 3.3.0 y anteriores (anteriormente Wildfire), no especifica apropiadamente una asignación de filtros en el archivo web.xml, lo que permite a atacantes remotos alcanzar privilegios y ejecutar código arbitrario mediante el acceso a la funcionalidad que se expone por medio de DWR, como es demostrado usando el descargador. • http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html http://secunia.com/advisories/25427 http://www.igniterealtime.org/issues/browse/JM-1049 http://www.osvdb.org/36713 http://www.securityfocus.com/bid/24205 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2006-7233
https://notcve.org/view.php?id=CVE-2006-7233
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el formulario de registro (login.js) de la consola de administración de Openfire (anteriormente Wildfire) 2.6.0, y puede que en otras versiones anteriores a 3.5.3, permite a atacantes remotos inyectar secuencias de comandos Web o HTML mediante el parámetro url. • http://secunia.com/advisories/31483 http://www.igniterealtime.org/issues/browse/JM-430 http://www.igniterealtime.org/issues/browse/JM-629 http://www.osvdb.org/47448 http://www.securityfocus.com/bid/30696 https://exchange.xforce.ibmcloud.com/vulnerabilities/44459 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4877
https://notcve.org/view.php?id=CVE-2005-4877
Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.3.0 Beta 2 allows remote attackers to inject arbitrary web script or HTML via Javascript events in the username parameter, a different vulnerability than CVE-2005-4876. • http://www.igniterealtime.org/issues/browse/JM-430 https://exchange.xforce.ibmcloud.com/vulnerabilities/44690 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •