Vulnerabilities > Igniterealtime > Openfire > 3.10.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-05-26 | CVE-2023-32315 | Path Traversal vulnerability in Igniterealtime Openfire Openfire is an XMPP server licensed under the Open Source Apache License. | 7.5 |
| 2022-03-18 | CVE-2021-45967 | Path Traversal vulnerability in multiple products An issue was discovered in Pascom Cloud Phone System before 7.20.x. | 9.8 |
| 2019-10-24 | CVE-2019-18394 | Server-Side Request Forgery (SSRF) vulnerability in Igniterealtime Openfire A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. | 7.5 |
| 2019-10-24 | CVE-2019-18393 | Path Traversal vulnerability in Igniterealtime Openfire PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. | 5.0 |
| 2019-08-23 | CVE-2019-15488 | Cross-site Scripting vulnerability in Igniterealtime Openfire Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test. | 4.3 |
| 2017-10-26 | CVE-2017-15911 | Cross-site Scripting vulnerability in Igniterealtime Openfire The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. | 3.5 |
| 2015-10-05 | CVE-2015-7707 | Permissions, Privileges, and Access Controls vulnerability in Igniterealtime Openfire 3.10.2 Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp. | 6.5 |
| 2015-09-16 | CVE-2015-6973 | Cross-Site Request Forgery (CSRF) vulnerability in Igniterealtime Openfire 3.10.2 Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp. | 6.8 |
| 2015-09-16 | CVE-2015-6972 | Cross-site Scripting vulnerability in Igniterealtime Openfire 3.10.2 Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group-summary.jsp. | 4.3 |