CVE-2014-8025

The Cisco advisory (Cisco Jabber Guest Server HTML5) describes a vulnerability in the Guest Server where missing encryption on sensitive data sent via HTTP GET/POST can be sniffed by an unauthenticated remote attacker to disclose information. Exploitation requires access to the network segment wh...

CVE-2014-8024

CVE-2014-8024 affects Cisco Jabber Guest Server: the API vulnerable due to insufficient validation of values passed via HTTP GET/POST, enabling an unauthenticated remote attacker to sniff network traffic and access sensitive information. Cisco notes no software updates are available; exploitation...

PT-2014-8389

Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description The issue allows remote attackers to obtain sensitive information by sniffing the network during an HTTP request, specifically when the HTML5 CORS feature is used in the Guest Server. Th...

CVE-2014-8026: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a 1 GET or 2 POST parameter, aka Bug ID CSCus08074...

CVE-2014-8025: Exposure of Sensitive Information to an Unauthorized Actor

The API in the Guest Server in Cisco Jabber, when HTML5 is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST response, aka Bug ID CSCus19801...

PT-2014-8391

Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description A cross-site scripting XSS issue exists in the Guest Server of Cisco Jabber, allowing remote attackers to inject arbitrary web script or HTML via a GET or POST parameter. Recommendations...

PT-2014-8390

Name of the Vulnerable Software and Affected Versions Cisco Jabber affected versions not specified Description The issue allows remote attackers to obtain sensitive information by sniffing the network during an HTTP response, specifically when using HTML5 in the Guest Server API. This can occur...

CVE-2014-8024: Exposure of Sensitive Information to an Unauthorized Actor

The API in the Guest Server in Cisco Jabber, when the HTML5 CORS feature is used, allows remote attackers to obtain sensitive information by sniffing the network during an HTTP 1 GET or 2 POST request, aka Bug ID CSCus19789...

Multiple packages, Multiple vulnerabilities fixed in 2012

Background For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild. Description Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. EGroupware VTE Layer Four...

Tuleap PHP Unserialize Code Execution

This module exploits a PHP object injection vulnerability in Tuleap use exploit/unix/webapp/tuleap/unserializeexec msf undefinedunserializeexec show actions ...actions... msf undefinedunserializeexec set ACTION msf undefinedunserializeexec show options ...show and set options... msf...

Pidgin 2.10.10 Patches SSL MiTM, DoS Vulnerabilities

A handful of security vulnerabilities were patched in the most recent release of the Pidgin open source instant messaging client, Pidgin 2.10.10, including a SSL/TLS certificate validation issue that could be exploited in man-in-the-middle attacks. Reported by Jacob Appelbaum of the Tor Project,...

[SECURITY] Fedora 20 Update: pidgin-2.10.10-1.fc20

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

[SECURITY] Fedora 21 Update: pidgin-2.10.10-2.fc21

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, SILC, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

DEBIAN-CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

Memory corruption

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...

CVE-2014-3698

CVE-2014-3698 affects Pidgin/libpurple (Jabber/XMPP) via the jabber_idn_validate function in jutil.c. A crafted XMPP message can cause the process to disclose memory belonging to the pidgin process (information disclosure). Upstream references and security advisories document this alongside relat...

CVE-2014-3698

The jabberidnvalidate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message...