Zoom Communications Registered Users Enumeration

Summary Zoom doesn’t properly validate certain XMPP requests coming from the clients, which can lead to disclosure of details about registered users. Tested Versions Zoom Service As Of April 9th 2020 Product URLs https://zoom.us CVSSv3 Score 6.5 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the Jingle extension of the Extensible Messaging and Presence Protocol XMPP protocol plug-in in Pidgin. A remote attacker could use these flaws to crash Pidgin via a specially-crafted Jingle multimedi...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. Multiple NULL pointer dereference flaws were found in the way Pidgin handled Base64 decoding. A remote attacker could use these flaws to crash Pidgin if the target Pidgin user was using the Yahoo! Messenger Protocol, MSN, MySpace, or Extensible Messaging...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A denial of service flaw was found in Finch's XMPP chat implementation, when using multi-user chat. If a Finch user in a multi-user chat session were to change their nickname to contain the HTML "br" element, it would cause Finch to crash...

Denial Of Service (DoS)

pidgin is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the Pidgin XMPP protocol plug-in processes IQ error responses when trying to fetch a custom smiley. A remote client could send a specially-crafted IQ error response that would crash Pidgin...

Information Disclosure

pidgin is vulnerable to information disclosure. It was discovered that, when connecting to certain, very old Jabber servers via XMPP, Pidgin may ignore the "Require SSL/TLS" setting. In these situations, a non-encrypted connection is established rather than the connection failing, causing the use...

Arbitrary Code Execution

pidgin is vulnerable to arbitrary code execution. The vulnerability exists as a buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol XMPP. If a Pidgin client initiates a file transfer, and the remote target sends a...

USN-4308-2: Twisted vulnerabilities

USN-4308-1 fixed several vulnerabilities in Twisted. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject...

USN-4306-1: Dino vulnerabilities

It was discovered that Dino incorrectly validated inputs. An attacker could use this issue to possibly obtain, inject or remove sensitive information. This update also includes a fix to the encryption implementation in Dino to support 12 byte IVs, in addition to 16 byte IVs...

CVE-2020-3160

A vulnerability in the Extensible Messaging and Presence Protocol XMPP feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition for users of XMPP conferencing applications. Other applications and processes are unaffected...

Design/Logic Flaw

A vulnerability in the Extensible Messaging and Presence Protocol XMPP feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition for users of XMPP conferencing applications. Other applications and processes are unaffected...

CVE-2020-3160 Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability

A vulnerability in the Extensible Messaging and Presence Protocol XMPP feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition for users of XMPP conferencing applications. Other applications and processes are unaffected...

CVE-2020-3160

CVE-2020-3160 is a Cisco Meeting Server XMPP Denial of Service vulnerability. The XMPP feature fails to validate crafted XMPP packets, allowing an unauthenticated remote attacker to crash the MPP meeting application and cause DoS for XMPP conferencing users. Connected sources confirm affected sof...

CVE-2020-3160 Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability

A vulnerability in the Extensible Messaging and Presence Protocol XMPP feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition for users of XMPP conferencing applications. Other applications and processes are unaffected...

Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability

A vulnerability in the Extensible Messaging and Presence Protocol XMPP feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition for users of XMPP conferencing applications. Other applications and processes are unaffected...

XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Impact What kind of vulnerability is it? Who is impacted? Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl. Patches Has the problem been patched? What versions should users upgrade to? Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of...

GHSA-PG97-WW7H-5MJR XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Impact What kind of vulnerability is it? Who is impacted? Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl. Patches Has the problem been patched? What versions should users upgrade to? Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of...

CVE-2019-10785

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them...

CVE-2016-9928

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets...

CVE-2016-9928

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets...