Openfire version 3.10.2 suffers from a cross site request forgery vulnerability.
0e24b5cc34f5f30e0f92cdca09e38caa5c6a3aa1e7231a61f43ed26e5a092d1cOpenfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This Metasploit module will use the vulnerability to create a new admin user that will be used to upload a Openfire management plugin weaponized with a java native payload that triggers remote code execution. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the first version on the 4.8 branch, which is version 4.8.0.
88a0702601cff01264e02916f842525d503acf8b450db38e6b24d4a2d9099b89CoreDial sipXcom sipXopenfire versions 21.04 and below suffer from XMPP message system command argument injection and insecure service file permissions that when chained together gives root.
b306297e359b80aaed39f16e6cdc8e7a70a93aff1cb4084d52e8dfcfadc31596Openfire version 4.6.0 suffers from multiple persistent cross site scripting vulnerabilities.
f9c7f42f5cd677f2e3c3280fd7992e2595856f2a86b2332e2d48c94b993b1751Openfire version 4.4.1 suffers from multiple cross site scripting vulnerabilities.
c8cd190de875e1a2748c12d3c36958a18961d0b35d125bc5fd41cb6f0f69ee0aIgnite Realtime Openfire version 3.7.1 suffers from a cross site scripting vulnerability.
c10f3c6ace6529c0ad221c414802d91b8aafa5e9cc0a5c883951f87d29b5c532Amazon S3 suffers from an open redirection vulnerability.
cc5afbb9a4b12138b7c5db47bdc0b8bb94e014dae51869e09b079aaf22a799b5Gentoo Linux Security Advisory 201612-50 - Multiple vulnerabilities have been found in Openfire, the worst of which could lead to privilege escalation. Versions less than 4.1.0 are affected.
3c1df0aaa23400fdf285f6cdd7ebc3a5090dc54bebf822e15d09feb645c3e10bOpenFire versions 3.10.2 through 4.0.1 suffer from cross site request forgery and cross site scripting vulnerabilities. These issues are similar as findings discovered by hyp3rlinx but leverage different pages.
be513ac2a1d466d9fc24adcadf3d11b3c22f9970e5d75746d50da08647e6334eCF Image Host version 1.6.6 suffers from multiple cross site scripting vulnerabilities.
5aebca1b9f045bc969d039b5496d6960cda4b824e2248290684f290c24ab8154CF Image Host version 1.6.6 suffers from a remote command injection vulnerability.
3bdd452cf772fc135e145528adbae009a496b93c527c63ea2a8b533c396898ccCF Image Host version 1.6.6 suffers from a cross site request forgery vulnerability.
3ae3bf2225e27dc0567a1770d302662b64ef0e7cbedf10d0c07be86aa05f8bd1b374k web shell versions 2.8 and 3.2.3 suffer from a cross site request forgery vulnerability that allows for remote command injection.
7a3f5f494c2b27e756fd6b73c4b14796921e7612b045ce5d5b218e90626c8178Microsoft .NET Framework suffers from cross site scripting and elevation of privilege vulnerabilities.
67e140fbcdfd0cfa86769915aa1660f8416cb51af113ed025468412f12623927NXFilter version 3.0.3 suffers from a cross site scripting vulnerability.
25d37f8adf5afa9c7c98764fff4c727777d4b671efb6c7a9a03dd0ec08335501NXFilter version 3.0.3 suffers from a cross site request forgery vulnerability.
7bc6dd411cd4472cf1c1681c9e4ae97ab9d2970ba375615bec05bd0f544a3f2dIf TCPing is called with an specially crafted CL argument it will cause an exception and overwrite the pointers to next SEH record and SEH handler with our buffer and malicious shellcode. Spetnik TCPing version 2.1.0 is affected.
f06cc5b1273a53dd542910fc1defe06e91902dd50c024cd10a345a30dfa1bc90PHP Server Monitor version 3.1.1 suffers from a privilege escalation vulnerability.
aafa69a15ff0e3770a96c5012d8cb850bdb3fda9ba48a991cb0678d1cb2b0ff6PHP Server Monitor version 3.1.1 suffers from a cross site request forgery vulnerability.
c6dd900ebf2986cd3b5ad60ba13c81ef576d594f7507b637176981a3472236faBlat version 2.7.6 suffers from a stack buffer overflow vulnerability.
21911e93027d280e190872f956f0eb12482a0f9573adbf3e42f6c5e7e8327a60If AdobeWorkgroupHelper.exe is called with an overly long command line argument it is vulnerable to a stack based buffer overflow exploit. Version 2.8.3.3 is affected.
ef450a73a8d6362812ddab4a5aa611d7e0c3cdb0cf7886a183004492328ce245Zope Management Interface version 4.3.7 suffers from a cross site request forgery vulnerability.
4a44c59001f1f7565864d480e019a3a4fd024ae8fa91414db943f1b82c6bccf1LanWhoIs.exe version 1.0.1.120 suffers from a buffer overflow vulnerability.
7574eb8ce3b4e579f9b7bdfda42d4551f13c05418bf0b8426310d33e3bde8949LanSpy version 2.0.0.155 suffers from a buffer overflow vulnerability.
2e17ea86e3b7e6207891ab7629ef137a4bc24466fafb4299bf5316035b1c6609FTGate 2009 SR3 May 13 2010 Build 6.4.000 suffers from multiple cross site scripting vulnerabilities.
99a355c0ad599328abceaf0fae609ea435adbf8015e3bff1bf74e184f3f138dbFTGate version 7 suffers from multiple cross site request forgery vulnerabilities.
fd79666db0bf16b4789a4b47b07c05cca8adffccf0476cac004649e4884f28ce
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed