Page 3 of 15 results (0.006 seconds)

CVSS: 7.5EPSS: 9%CPEs: 25EXPL: 3

CVE-2008-6509 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6509

SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp. Vulnerabilidad de inyección de SQL en CallLogDAO en el complemento SIP para Openfire 3.6.0a y anteriores permite a atacantes remotos ejecutar comandos SQL a través del parámetro tipo (type) de sipark-log-summary.jsp. • https://www.exploit-db.com/exploits/7075 http://osvdb.org/51912 http://secunia.com/advisories/32478 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.andreas-kurtz.de/archives/63 http://www.igniterealtime.org/issues/browse/JM-1488 http://www.securityfocus.com/archive/1/498162/100/0/threaded http://www.securityfocus.com/bid/32189 http://www.vupen.com/english/advisories/2008/3061 https://exchange.xforce.ibmcloud.com/vulnerabilities/46487 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 3

CVE-2008-6510 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6510

Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en login.jsp en la Consola de Administración de Openfire 3.6.0a y anteriores permite a atacantes remotos inyectar HTML o scripts web arbitrarios a través del parámetro URL. • https://www.exploit-db.com/exploits/7075 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.igniterealtime.org/issues/browse/JM-629 http://www.securityfocus.com/archive/1/498162/100/0/threaded http://www.securityfocus.com/bid/32189 http://www.vupen.com/english/advisories/2008/3061 https://exchange.xforce.ibmcloud.com/vulnerabilities/46486 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.8EPSS: 0%CPEs: 25EXPL: 2

CVE-2008-6511 – Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-6511

Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. Vulnerabilidad de redirección abierta en login.jsp en Openfire 3.6.0a y anteriores permite a atacantes remotos redirigir a los usuarios a sitios Web arbitrarios y llevar a cabo ataques de phishing a través del parámetro URL. • https://www.exploit-db.com/exploits/7075 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.securityfocus.com/archive/1/498162/100/0/threaded • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 0

CVE-2007-2975

https://notcve.org/view.php?id=CVE-2007-2975

The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader. La consola de administración de Ignite Realtime Openfire versiones 3.3.0 y anteriores (anteriormente Wildfire), no especifica apropiadamente una asignación de filtros en el archivo web.xml, lo que permite a atacantes remotos alcanzar privilegios y ejecutar código arbitrario mediante el acceso a la funcionalidad que se expone por medio de DWR, como es demostrado usando el descargador. • http://blogs.reucon.com/srt/2007/05/11/openfire_3_3_1_fixes_critical_security_issue.html http://secunia.com/advisories/25427 http://www.igniterealtime.org/issues/browse/JM-1049 http://www.osvdb.org/36713 http://www.securityfocus.com/bid/24205 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2006-7233

https://notcve.org/view.php?id=CVE-2006-7233

Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el formulario de registro (login.js) de la consola de administración de Openfire (anteriormente Wildfire) 2.6.0, y puede que en otras versiones anteriores a 3.5.3, permite a atacantes remotos inyectar secuencias de comandos Web o HTML mediante el parámetro url. • http://secunia.com/advisories/31483 http://www.igniterealtime.org/issues/browse/JM-430 http://www.igniterealtime.org/issues/browse/JM-629 http://www.osvdb.org/47448 http://www.securityfocus.com/bid/30696 https://exchange.xforce.ibmcloud.com/vulnerabilities/44459 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •