Skip to content
Noroxi

igniterealtime records

43 published records for vendor igniterealtime.

Researcher profile

Entered KEV
1 · 2.3%
Weaponized
2 · 4.7%
Pre-auth RCE
2
With a fix record
37.2%
Median publish → KEV
90 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

43 records
  • CVE-2023-32315
    90Now

    Openfire administration console authentication bypass

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    igniterealtime · openfireMay 26, 2023

  • CVE-2008-6508
    55Plan

    Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to byp

    HighCVSS 7.5WeaponizedEPSS 83%

    igniterealtime · openfireMar 23, 2009

  • CVE-2019-18394
    49Plan

    A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    igniterealtime · openfireOct 24, 2019

  • CVE-2015-6973
    46Plan

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentic

    MediumCVSS 6.8Proof of conceptEPSS 64%

    igniterealtime · openfireSep 16, 2015

  • CVE-2021-45967
    45Plan

    An issue was discovered in Pascom Cloud Phone System before 7.20.x.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    pascom · cloud phone systemMar 18, 2022

  • CVE-2024-25421
    39Monitor

    An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.

    CriticalCVSS 9.8No exploitEPSS 1%

    igniterealtime · openfireMar 26, 2024

  • CVE-2020-12772
    36Monitor

    An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows.

    HighCVSS 8.8No exploitEPSS 1%

    igniterealtime · sparkMay 12, 2020

  • CVE-2014-2741
    32Monitor

    nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements,

    HighCVSS 7.8No exploitEPSS 3%

    igniterealtime · openfireApr 10, 2014

  • CVE-2017-2815
    32Monitor

    An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0.

    HighCVSS 8.1No exploitEPSS 0%

    igniterealtime · user import exportMay 15, 2018

  • CVE-2008-6509
    31Monitor

    SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL comm

    HighCVSS 7.5Proof of conceptEPSS 2%

    igniterealtime · openfireMar 23, 2009

  • CVE-2014-3451
    31Monitor

    OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.

    HighCVSS 7.5No exploitEPSS 1%

    igniterealtime · openfireAug 18, 2017

  • CVE-2015-7707
    28Monitor

    Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.j

    MediumCVSS 6.5Proof of conceptEPSS 6%

    igniterealtime · openfireOct 5, 2015

  • CVE-2024-25420
    28Monitor

    An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system proper

    HighCVSS 7.2No exploitEPSS 1%

    igniterealtime · openfireMar 26, 2024

  • CVE-2014-5075
    27Monitor

    The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostn

    MediumCVSS 6.8No exploitEPSS 0%

    redhat · jboss fuseOct 25, 2014

  • CVE-2009-1596
    26Monitor

    Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration settin

    MediumCVSS 6.5No exploitEPSS 1%

    igniterealtime · openfireMay 11, 2009

  • CVE-2019-18393
    25Monitor

    PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct

    MediumCVSS 5.3Proof of conceptEPSS 13%

    igniterealtime · openfireOct 24, 2019

  • CVE-2018-11688
    25Monitor

    Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

    MediumCVSS 6.1No exploitEPSS 2%

    igniterealtime · openfireJun 13, 2018

  • CVE-2008-6511
    24Monitor

    Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and

    MediumCVSS 5.8Proof of conceptEPSS 1%

    igniterealtime · openfireMar 23, 2009

  • CVE-2019-20363
    24Monitor

    An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireJan 8, 2020

  • CVE-2019-20366
    24Monitor

    An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireJan 8, 2020

  • CVE-2019-20365
    24Monitor

    An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireJan 8, 2020

  • CVE-2019-20364
    24Monitor

    An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireJan 8, 2020

  • CVE-2020-24604
    24Monitor

    A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireSep 2, 2020

  • CVE-2020-24602
    24Monitor

    Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious UR

    MediumCVSS 6.1No exploitEPSS 1%

    igniterealtime · openfireSep 2, 2020

  • CVE-2020-35200
    24Monitor

    Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

    MediumCVSS 6.1No exploitEPSS 0%

    igniterealtime · openfireDec 12, 2020