Org.igniterealtime.openfire:parent

This hub aggregates every CVE we track for Org.igniterealtime.openfire:parent, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Org.igniterealtime.openfire:parent.

• CVE-2019-20526Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.6.1Mar 19, 2020
• CVE-2019-20525Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.6.1Mar 19, 2020
• CVE-2019-20527Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.6.1Mar 19, 2020
• CVE-2019-20366An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.6.1Jan 8, 2020
• CVE-2019-18394A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.9.8Oct 24, 2019
• CVE-2019-18393PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.5.3Oct 24, 2019
• CVE-2018-11688Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted U...6.1Jun 13, 2018
• CVE-2017-15911The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, a...4.8Oct 26, 2017
• CVE-2014-2741nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of servi...7.8Apr 11, 2014
• CVE-2009-1595The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified usern...4.0May 11, 2009
• CVE-2008-1728ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messa...4.0Apr 11, 2008