Igniterealtime Openfire
39 CVEs affecting Igniterealtime Openfire. Latest disclosed: 2026-01-26. Critical: 3, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25421 | Critical | 9.8 | 2024-03-26 | An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. |
CVE-2021-45967 | Critical | 9.8 | 2022-03-18 | An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal i… |
CVE-2019-18394 | Critical | 9.8 | 2019-10-24 | A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET… |
CVE-2023-32315 | High | 8.6 | 2023-05-26 | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerabl… |
CVE-2014-3451 | High | 7.5 | 2017-08-18 | OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks. |
CVE-2024-25420 | High | 7.2 | 2024-03-26 | An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. |
CVE-2009-1596 | Medium | 6.5 | 2009-05-11 | Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows rem… |
CVE-2020-36956 | Medium | 6.4 | 2026-01-26 | Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' p… |
CVE-2020-35200 | Medium | 6.1 | 2020-12-12 | Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. |
CVE-2020-24604 | Medium | 6.1 | 2020-09-02 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web s… |
CVE-2020-24602 | Medium | 6.1 | 2020-09-02 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerabl… |
CVE-2020-24601 | Medium | 6.1 | 2020-09-02 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter… |
CVE-2019-20526 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. |
CVE-2019-20525 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. |
CVE-2019-20527 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. |
CVE-2019-20528 | Medium | 6.1 | 2020-03-18 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. |
CVE-2019-20366 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents. |
CVE-2019-20365 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page. |
CVE-2019-20364 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp. |
CVE-2019-20363 | Medium | 6.1 | 2020-01-08 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents. |