CVE-2019-15488

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-154896.1laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.CVE-2019-15495.3OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system CVE-2019-154909.8openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.CVE-2019-154918.8openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.CVE-2019-154926.1openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.CVE-2019-154937.5openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.CVE-2019-154949.8openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.CVE-2019-154968.8MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker trickiCVE-2019-154979.8Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that CVE-2019-154988.8cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --outpuCVE-2019-154996.1CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with CVE-2019-155016.1Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
CVE-2019-15488: Medium severity, CVSS 6.1 | Vulnix