CVE-2021-32917

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth...

CVE-2021-32917

Prosody (before 0.11.9) is affected by CVE-2021-32917 due to the proxy65 component allowing open access by default, enabling unrestricted use of the server’s bandwidth when mod_proxy65 is enabled. The issue arises even if no local XMPP accounts exist, exposing potential abuse of resources. Public...

CVE-2021-32917

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth...

Prosodical Thoughts Prosody 资源管理错误漏洞

Prosodical Thoughts Prosody is a Prosodical Thoughts open source application . A modern XMPP communication server. A security vulnerability exists in Prosody prior to version 0.11.9. A remote attacker could exploit the vulnerability to cause a denial of service to the program...

Prosody -- multiple vulnerabilities

The Prosody security advisory 2021-05-12 reports: This advisory details 5 new security vulnerabilities discovered in the Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release default configuration. CVE-2021-32918: DoS via insufficient memory consumption controls...

EulerOS 2.0 SP3 : wireshark (EulerOS-SA-2021-1859)

According to the versions of the wireshark packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21634

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21634

CVE-2021-21634 affects the Jenkins Jabber (XMPP) notifier and control Plugin: versions 1.41 and earlier store passwords in plaintext in the global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller, exposing credentials to users with filesystem acc...

CVE-2021-21634: Insufficiently Protected Credentials

Jenkins Jabber XMPP notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Critical Cisco Jabber Bug Could Let Attackers Hack Remote Systems

Cisco on Wednesday released software updates to address multiple vulnerabilities affecting its Jabber messaging clients across Windows, macOS, Android, and iOS. Successful exploitation of the flaws could permit an "attacker to execute arbitrary programs on the underlying operating system with...

Critical Cisco Jabber Bug Could Let Attackers Hack Remote Systems

Cisco on Wednesday released software updates to address multiple vulnerabilities affecting its Jabber messaging clients across Windows, macOS, Android, and iOS. Successful exploitation of the flaws could permit an "attacker to execute arbitrary programs on the underlying operating system with...

Cisco Jabber Information Disclosure Vulnerability (CNVD-2021-22911)

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber has an information disclosure vulnerability that can be exploited by an attacker by sending a crafted XMPP message to the...

Cisco Jabber Code Execution Vulnerability

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber suffers from a code execution vulnerability that stems from an email content validation error. An attacker could exploit thi...

Cisco Jabber Denial of Service Vulnerability

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber has a denial of service vulnerability that can be exploited by an attacker by sending a crafted XMPP message to the target...

Cisco Jabber Code Execution Vulnerability (CNVD-2021-22912)

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. A code execution vulnerability exists in Cisco Jabber, which is caused by incorrect validation of message content. An attacker can send...

PT-2021-2344

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows affected versions not specified Cisco Jabber for MacOS affected versions not specified Cisco Jabber for mobile platforms affected versions not specified Description The issue allows an attacker to execute arbitrary...

PT-2021-2369 · Cisco · Cisco Jabber For Windows +2

Name of the Vulnerable Software and Affected Versions: Cisco Jabber for Windows affected versions not specified Cisco Jabber for MacOS affected versions not specified Cisco Jabber for mobile platforms affected versions not specified Description: The issue is related to insufficient input validati...

PT-2021-2343

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows affected versions not specified Cisco Jabber for MacOS affected versions not specified Cisco Jabber for mobile platforms affected versions not specified Description The issue allows an attacker to execute arbitrary...

USN-4834-1: Prosody vulnerability

It was discovered that Prosody incorrectly validated the virtual host associated with a user session across stream restarts. A remote attacker could use this issue to gain unintended access to resources...