Page 3 of 18 results (0.003 seconds)

CVSS: 7.5EPSS: 9%CPEs: 25EXPL: 3

CVE-2008-6509 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6509

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp. Vulnerabilidad de inyección de SQL en CallLogDAO en el complemento SIP para Openfire 3.6.0a y anteriores permite a atacantes remotos ejecutar comandos SQL a través del parámetro tipo (type) de sipark-log-summary.jsp. • https://www.exploit-db.com/exploits/7075 http://osvdb.org/51912 http://secunia.com/advisories/32478 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.andreas-kurtz.de/archives/63 http://www.igniterealtime.org/issues/browse/JM-1488 http://www.securityfocus.com/archive/1/498162/100/0/threaded http://www.securityfocus.com/bid/32189 http://www.vupen.com/english/advisories/2008/3061 https://exchange.xforce.ibmcloud.com/vulnerabilities/46487 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 3

CVE-2008-6510 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6510

Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en login.jsp en la Consola de Administración de Openfire 3.6.0a y anteriores permite a atacantes remotos inyectar HTML o scripts web arbitrarios a través del parámetro URL. • https://www.exploit-db.com/exploits/7075 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.igniterealtime.org/issues/browse/JM-629 http://www.securityfocus.com/archive/1/498162/100/0/threaded http://www.securityfocus.com/bid/32189 http://www.vupen.com/english/advisories/2008/3061 https://exchange.xforce.ibmcloud.com/vulnerabilities/46486 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.8EPSS: 0%CPEs: 25EXPL: 2

CVE-2008-6511 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6511

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. Vulnerabilidad de redirección abierta en login.jsp en Openfire 3.6.0a y anteriores permite a atacantes remotos redirigir a los usuarios a sitios Web arbitrarios y llevar a cabo ataques de phishing a través del parámetro URL. • https://www.exploit-db.com/exploits/7075 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.securityfocus.com/archive/1/498162/100/0/threaded • CWE-20: Improper Input Validation •

CVSS: 4.0EPSS: 1%CPEs: 1EXPL: 0

CVE-2008-1728

https://notcve.org/view.php?id=CVE-2008-1728

ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages. ConnectionManagerImpl.java en Ignite Realtime Openfire 3.4.5 permite a usuarios remotos autenticados provocar una denegación de servicio (interrupción del demonio) desencadenando grandes colas de salida sin leer los mensajes. • http://secunia.com/advisories/29751 http://secunia.com/advisories/29901 http://security.gentoo.org/glsa/glsa-200804-26.xml http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html http://www.igniterealtime.org/fisheye/changelog/svn-org?cs=10031 http://www.igniterealtime.org/issues/browse/JM-1289 http://www.openwall.com/lists/oss-security/2008/04/10/7 http://www.securityfocus.com/bid/28722 http://www.vupen.com/english/advisories/2008/1188/references https:/&#x • CWE-399: Resource Management Errors •

CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 0

CVE-2007-2975

https://notcve.org/view.php?id=CVE-2007-2975

The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader. La consola de administración de Ignite Realtime Openfire versiones 3.3.0 y anteriores (anteriormente Wildfire), no especifica apropiadamente una asignación de filtros en el archivo web.xml, lo que permite a atacantes remotos alcanzar privilegios y ejecutar código arbitrario mediante el acceso a la funcionalidad que se expone por medio de DWR, como es demostrado usando el descargador. • http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html http://secunia.com/advisories/25427 http://www.igniterealtime.org/issues/browse/JM-1049 http://www.osvdb.org/36713 http://www.securityfocus.com/bid/24205 • CWE-264: Permissions, Privileges, and Access Controls •