PT-2020-14304

Name of the Vulnerable Software and Affected Versions xmpp-http-upload versions prior to 0.4.0 Description The issue allows attackers to read files with a .data suffix and accompanied by a JSON file with the .meta suffix when the GET method is attacked. This can lead to Information Disclosure and...

CVE-2020-15239: Improper Limitation of a Pathname to a Restricted Directory

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of...

[SECURITY] Fedora 33 Update: prosody-0.11.7-1.fc33

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

USN-4506-1: MCabber vulnerability

It was discovered that MCabber does not properly manage roster pushes. An attacker could possibly use this issue to remotely perform machine-in-the-middle attacks. CVE-2016-9928...

CVE-2020-3495

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

CVE-2020-3495

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

Input validation

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

CVE-2020-3495 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

CVE-2020-3495 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

CVE-2020-3495

CVE-2020-3495 affects Cisco Jabber for Windows. The vulnerability stems from improper validation of message contents in XMPP/XHTML-IM handling, allowing an authenticated remote attacker to execute arbitrary code by sending specially crafted messages. Exploitation could run code with the user’s pr...

CVE-2020-3495: Improper Input Validation

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

Cisco Jabber for Windows Message Handling Arbitrary Code Execution (cisco-sa-jabber-UyTKCPGg)

According to its self-reported version, Cisco Jabber is affected by a arbitrary code execution vulnerability. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence Protocol...

Attackers Can Exploit Critical Cisco Jabber Flaw With One Message

Researchers are warning of a critical remote code-execution RCE flaw in the Windows version of Cisco Jabber, the networking company’s video-conferencing and instant-messaging application. Attackers can exploit the flaw merely by sending targets specially crafted messages – no user interaction...

Cisco Jabber Bug Could Let Hackers Target Windows Systems Remotely

Networking equipment maker Cisco has released a new version of its Jabber video conferencing and messaging app for Windows that includes patches for multiple vulnerabilities—which, if exploited, could allow an authenticated, remote attacker to execute arbitrary code. The flaws, which were uncover...

Cross-Site Scripting (XSS)

xmppserver is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the security truststore page...

PT-2020-3843

Name of the Vulnerable Software and Affected Versions: Cisco Jabber for Windows affected versions not specified Description: A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code due to improper validation of message contents. An...

Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence...

ZyXEL CloudCNM SecuManager Trust Management Issues Vulnerability

ZyXEL CloudCNM SecuManager is a set of network management software from Taiwan, China-based ZyXEL. The software supports centralized control, device management and intelligent monitoring. A trust management issue vulnerability exists in ZyXEL CloudCNM SecuManager version 3.1.0 and 3.1.1, which...

PT-2020-14361

Name of the Vulnerable Software and Affected Versions Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description The issue concerns a world-readable file that stores hardcoded credentials. The file in question is xmpp config.py, located at axess/opt/axXMPPHandler/config/. This poses a...

Debian DLA-2260-1 : mcabber security update

It was discovered that there was a 'roster push attack' in mcabber, a console-based Jabber XMPP client. This is identical to CVE-2015-8688 for gajim. For Debian 8 'Jessie', this problem has been fixed in version 0.10.2-1+deb8u1. We recommend that you upgrade your mcabber packages. NOTE: Tenable...