93 matches found
CVE-2018-15720
Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...
CVE-2018-15720
Affected product: Logitech Harmony Hub. Vulnerability: hard-coded XMPP accounts in the hub’s XMPP server allow remote, unauthenticated access to the local API. Root cause: exposed credentials baked into the firmware prior to 4.15.206. Impact: potential remote control of the hub APIs; effect on co...
CVE-2018-15721
The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...
CVE-2018-15720
Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...
CVE-2018-15720: Use of Hard-coded Credentials
Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...
PT-2018-13171
Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue concerns an authentication bypass vulnerability in the XMPP server of the Logitech Harmony Hub. This vulnerability can be exploited by remote attackers using a crafted XMPP...
PT-2018-13170
Name of the Vulnerable Software and Affected Versions Logitech Harmony Hub versions prior to 4.15.206 Description The issue concerns hard-coded accounts in the XMPP server, allowing remote users to access the local API. Recommendations For versions prior to 4.15.206, update to version 4.15.206 or...
CVE-2018-15721: Improper Authentication
The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...
[SECURITY] Fedora 26 Update: ejabberd-17.01-3.fc26
ejabberd is a Free and Open Source distributed fault-tolerant Jabber/XMPP server. It is mostly written in Erlang, and runs on many platforms tested on Linux, FreeBSD, NetBSD, Solaris, Mac OS X and Windows NT/2000/XP...
Design/Logic Flaw
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...
CVE-2014-3451
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...
CVE-2014-3451: Improper Certificate Validation
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...
Debian Security Advisory DSA 3463-1 (prosody - security update)
It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server. OpenVAS Vulnerability Test $Id: deb3463.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3463-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbo...
Debian: Security Advisory (DSA-3463-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 3463-1] prosody security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3463-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 31, 2016 https://www.debian.org/security/faq -...
DSA-3463-1 prosody - security update
Bulletin has no description...
CVE-2014-9757: Deserialisation Through Smack Resulting in Remote Code Execution Vulnerability
Bamboo used an old version of the Smack XMPP library that deserialises messages received from XMPP. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo if a XMPP connection has been configured. To exploit this issue, Bamboo...
Incorrect handling of self signed certificates in OpenFire XMPP Server
Incorrect handling of self signed certificates in OpenFire XMPP Server Affected software: OpenFire XMPP server Affected versions: 3.9.3 and earlier Vulnerabilities addressed: CVE-2014-3451, CVE-2015-2080 Openfire is a real time collaboration RTC server licensed under the Open Source Apache Licens...
Debian Security Advisory DSA 2895-1 (prosody - security update)
A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as zip bomb over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected by...