IG
Vendor
igniterealtime
45
CVEs
1
On KEV
0
New 30D
Products
OP9.8
Openfire
igniterealtime
39 CVEs1 on KEV0 new
SM5.9
Smack
Igniterealtime
3 CVEs0 on KEV0 new
SA–
Smack Api
Igniterealtime
1 CVEs0 on KEV0 new
SP8.8
Spark
Igniterealtime
1 CVEs0 on KEV0 new
UI8.1
User Import Export
Igniterealtime
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-36956 | OP Openfire igniterealtime | 6.4 | Jan 26 | Openfire 4.6.0 - 'path' Stored XSS |
| CVE-2025-59154 | OP Openfire igniterealtime | 5.9 | Sep 15 | Openfire allows potential identity spoofing via unsafe CN parsing |
| CVE-2024-25421 | OP Openfire Igniterealtime | 9.8 | Mar 26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component |
| CVE-2024-25420 | OP Openfire Igniterealtime | 7.2 | Mar 26 | An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component |
| CVE-2023-32315 In wildKEV | OP Openfire igniterealtime | 7.5 | May 26 | Openfire administration console authentication bypass |
| CVE-2021-45967 | OP Openfire Igniterealtime | 9.8 | Mar 18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x |
| CVE-2020-35202 | OP Openfire Igniterealtime | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS |
| CVE-2020-35201 | OP Openfire Igniterealtime | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS |
| CVE-2020-35200 | OP Openfire Igniterealtime | 6.1 | Dec 12 | Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS |
| CVE-2020-35199 | OP Openfire Igniterealtime | 5.4 | Dec 12 | Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS |
| CVE-2020-35127 | OP Openfire Igniterealtime | 5.4 | Dec 11 | Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS |
| CVE-2020-24604 | OP Openfire Igniterealtime | 6.1 | Sep 2 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1 |
| CVE-2020-24602 | OP Openfire Igniterealtime | 6.1 | Sep 2 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter… |
| CVE-2020-24601 | OP Openfire Igniterealtime | 6.1 | Sep 2 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias"… |
| CVE-2020-12772 | SP Spark Igniterealtime | 8.8 | May 12 | An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows |
| CVE-2019-20526 | OP Openfire Igniterealtime | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter |
| CVE-2019-20525 | OP Openfire Igniterealtime | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter |
| CVE-2019-20527 | OP Openfire Igniterealtime | 6.1 | Mar 19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter |
| CVE-2019-20528 | OP Openfire Igniterealtime | 6.1 | Mar 18 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter |
| CVE-2019-20366 | OP Openfire Igniterealtime | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents |
| CVE-2019-20365 | OP Openfire Igniterealtime | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page |
| CVE-2019-20364 | OP Openfire Igniterealtime | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp |
| CVE-2019-20363 | OP Openfire Igniterealtime | 6.1 | Jan 8 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents |
| CVE-2019-18394 | OP Openfire Igniterealtime | 9.8 | Oct 24 | A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests |
| CVE-2019-18393 | OP Openfire Igniterealtime | 5.3 | Oct 24 | PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal… |
| CVE-2019-15488 | OP Openfire Igniterealtime | 6.1 | Aug 23 | Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test |
| CVE-2018-11688 | OP Openfire Igniterealtime | 6.1 | Jun 13 | Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input |
| CVE-2017-2815 | UI User Import Export Igniterealtime | 8.1 | May 15 | An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0 |
| CVE-2017-15911 | OP Openfire Igniterealtime | 4.8 | Oct 26 | The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted… |
| CVE-2014-3451 | OP Openfire Igniterealtime | 7.5 | Aug 18 | OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks |
| CVE-2016-10027 | SM Smack Igniterealtime | 5.9 | Jan 12 | Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and… |
| CVE-2015-7707 | OP Openfire Igniterealtime | – | Oct 5 | Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp |
| CVE-2015-6973 | OP Openfire Igniterealtime | – | Sep 16 | Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests… |
| CVE-2015-6972 | OP Openfire Igniterealtime | – | Sep 16 | Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName… |
| CVE-2014-5075 | SA Smack Api Igniterealtime | – | Oct 25 | The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the… |
| CVE-2014-0364 | SM Smack Igniterealtime | – | Apr 30 | The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to… |
| CVE-2014-0363 | SM Smack Igniterealtime | – | Apr 30 | The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL… |
| CVE-2014-2741 | OP Openfire Igniterealtime | – | Apr 11 | nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause… |
| CVE-2009-1596 | OP Openfire Igniterealtime | 6.5 | May 11 | Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated… |
| CVE-2009-1595 | OP Openfire Igniterealtime | – | May 11 | The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts… |
| CVE-2008-6511 | OP Openfire Igniterealtime | – | Mar 23 | Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url… |
| CVE-2008-6510 | OP Openfire Igniterealtime | – | Mar 23 | Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2008-6509 | OP Openfire Igniterealtime | – | Mar 23 | SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to… |
| CVE-2008-6508 | OP Openfire Igniterealtime | – | Mar 23 | Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin… |
| CVE-2009-0497 | OP Openfire Igniterealtime | – | Feb 10 | Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter |