XSS in Ignite Realtime Openfire via isTrustStore

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-20366 · ADVISORY
• igniterealtime/Openfire#1561 · WEB
• igniterealtime/Openfire commit fef55d4 · WEB
• cybersecurityworks.com/zerodays/cve-2019-20366-openfire.html · WEB
• igniterealtime/Openfire · PACKAGE
• issues.igniterealtime.org/browse/OF-1955 · WEB

Lỗ hổng khác của org.igniterealtime.openfire:parent

• CVE-2019-20526TRUNG BÌNH 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.
• CVE-2019-20525TRUNG BÌNH 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
• CVE-2019-20527TRUNG BÌNH 6.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.
• CVE-2019-18394NGHIÊM TRỌNG 9.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send…
• CVE-2019-18393TRUNG BÌNH 5.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct…