[SECURITY] Fedora 36 Update: pidgin-2.14.8-3.fc36

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just add an...

[SECURITY] Fedora 34 Update: pidgin-2.14.1-4.fc34

Pidgin allows you to talk to anyone using a variety of messaging protocols including AIM, MSN, Yahoo!, Jabber, Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ, Lotus Sametime, Simple and Zephyr. These protocols are implemented using a modular, easy to use design. To use a protocol, just add an...

CVE-2022-22784

The Zoom Client for Meetings for Android, iOS, Linux, MacOS, and Windows before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users clien...

CVE-2022-1753

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...

IBM MQ for HPE NonStop Information Disclosure Vulnerability

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. An information disclosure vulnerability exists in IBM MQ for HPE NonStop version 8.1.0, which can be exploited b...

Denial Of Service (DoS)

spring-messaging is vulnerable to denial of service. The vulnerability exists because the handleMessageInternal function of SimpleBrokerMessageHandler.java does not properly handle to ignore the invalid STOMP frames, allowing an attacker to cause an application crash through the WebSocket endpoin...

SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin

A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint...

GHSA-G3GJ-632X-FHRH SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin

A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint...

Moodle improper access control

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

GHSA-M7CC-6VHG-39WR Moodle improper access control

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API...

GHSA-4JM2-C9JR-6PRF Moodle allows attackers to bypass a messaging-disabled setting

message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request...

Moodle allows attackers to bypass a messaging-disabled setting

message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +40 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.0.release)

org.springframework:spring-messaging MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

com.bq.corbel.lib:rabbitmq (0.11.0), com.bq.corbel.lib:ws (0.24.0) +92 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.2.7.release)

org.springframework:spring-messaging MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.bq.corbel.lib:rabbitmq 0.11.0 - com.bq.corbel.lib:ws 0.24.0 -...

com.blitline:blitline-image-client-spring (>=0.10.1, <=0.12.0) potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.4.release)

org.springframework:spring-messaging MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.blitline:blitline-image-client-spring =0.10.1, =0.12.0 Source cves:...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +3354 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.0.0.release, <=5.2.21.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =0.5.0, =0.0.4-alpha, =3.4.0, =4.1.0, =4.1.0, =3.6.0, =5.2.0, =5.1.0, =3.1.0, =5.1.0, =3.5.0, =5.1.0, =5.1.0, =4.0.0, =3.7.0, =5.2.1 and more Source cves: CVE-2022-22971 Source advisory: OSV:GHSA-RQPH-VQWM-22VC...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.2.9.release_1), org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-ws-support (>=2.4.2.release_1, <=2.4.2.release_2) +36 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.2.9.release)

org.springframework:spring-messaging MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...

ch.rasc:wampspring (1.1.1), ch.rasc:wampspring-security (1.1.1) +144 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.6.release)

org.springframework:spring-messaging MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ch.rasc:wampspring 1.1.1 - ch.rasc:wampspring-security 1.1.1 -...

com.bluelock:camel-spring-amqp (1.7.0), com.javaetmoi.core:spring-batch-toolkit (>=0.3.0-m1, <=1.0.1) +43 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.3.release)

org.springframework:spring-messaging MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.bluelock:camel-spring-amqp 1.7.0 - com.javaetmoi.core:spring-batch-toolkit...

org.apache.activemq:activemq-camel (5.15.14), org.apache.activemq:activemq-http (5.15.14) +5 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.29.release)

org.springframework:spring-messaging MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.activemq:activemq-camel 5.15.14 - org.apache.activemq:activemq-http...