CVE-2009-1596

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration setting, which allows remote authenticated users to bypass intended policy and change their own passwords via a passwd_change IQ packet.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-15979.3Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in a CVE-2009-15989.3Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an CVE-2009-15999.3Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline P CVE-2009-16009.3Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an i CVE-2009-16016.8The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working CVE-2009-16025.0Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumptio CVE-2009-16037.5src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with inc CVE-2009-16047.5Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack CVE-2009-16055.4Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used CVE-2009-16069.3Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote CVE-2009-16074.3Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers to inject arbitrary CVE-2009-16089.3Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrar