Vulnerabilities > Igniterealtime > Openfire > 4.4.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-05-26 | CVE-2023-32315 | Path Traversal vulnerability in Igniterealtime Openfire Openfire is an XMPP server licensed under the Open Source Apache License. | 7.5 |
| 2022-03-18 | CVE-2021-45967 | Path Traversal vulnerability in multiple products An issue was discovered in Pascom Cloud Phone System before 7.20.x. | 9.8 |
| 2020-03-19 | CVE-2019-20526 | Cross-site Scripting vulnerability in Igniterealtime Openfire 4.4.1 Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. | 6.1 |
| 2020-03-19 | CVE-2019-20525 | Cross-site Scripting vulnerability in Igniterealtime Openfire 4.4.1 Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. | 6.1 |
| 2020-03-19 | CVE-2019-20527 | Cross-site Scripting vulnerability in Igniterealtime Openfire 4.4.1 Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. | 6.1 |
| 2020-03-18 | CVE-2019-20528 | Cross-site Scripting vulnerability in Igniterealtime Openfire 4.4.1 Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. | 6.1 |
| 2019-10-24 | CVE-2019-18394 | Server-Side Request Forgery (SSRF) vulnerability in Igniterealtime Openfire A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. | 9.8 |
| 2019-10-24 | CVE-2019-18393 | Path Traversal vulnerability in Igniterealtime Openfire PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. | 5.3 |