CVE-2014-9757

CVE-2014-9757 affects Atlassian Bamboo prior to 5.9.9 and 5.10.x prior to 5.10.0, due to a deserialization vulnerability in the Ignite Realtime Smack XMPP API used by Bamboo. Remote configured XMPP servers can send serialized data in XMPP messages to execute arbitrary Java code on Bamboo servers....

CVE-2016-1307

The Openfire server in Cisco Finesse Desktop 10.51 and 11.01 and Unified Contact Center Express 10.61 has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085...

Hardcoded credentials

The Openfire server in Cisco Finesse Desktop 10.51 and 11.01 and Unified Contact Center Express 10.61 has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085...

CVE-2016-1307

CVE-2016-1307 affects Cisco Finesse Desktop and Cisco Unified Contact Center Express Openfire server. A default, non-changeable XMPP account enables unauthenticated remote login to the Openfire service, allowing access via XMPP with a non-administrative account. Cisco’s advisory Cisco Security Ad...

CVE-2016-1307

The Openfire server in Cisco Finesse Desktop 10.51 and 11.01 and Unified Contact Center Express 10.61 has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085...

[SECURITY] Fedora 23 Update: prosody-0.9.10-1.fc23

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

Debian Security Advisory DSA 3463-1 (prosody - security update)

It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server. OpenVAS Vulnerability Test $Id: deb3463.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3463-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbo...

Debian: Security Advisory (DSA-3463-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco Finesse Desktop and Cisco Unified Contact Center Express Applications XMPP Unauthorized Access Vulnerability

A vulnerability in the Extensible Messaging and Presence Protocol XMPP in the Cisco Finesse Desktop and Cisco Unified Contact Center Express applications could allow an unauthenticated, remote attacker to log in to the device with a default account with a static password. This account provides...

Debian DSA-3463-1 : prosody - security update

It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3463. The text...

[SECURITY] [DSA 3463-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3463-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 31, 2016 https://www.debian.org/security/faq -...

DSA-3463-1 prosody - security update

Bulletin has no description...

[SECURITY] [DLA 407-1] prosody security update

Package : prosody Version : 0.7.0-1squeeze1+deb6u2 CVE ID : CVE-2016-0756 The flaw allows a malicious server to impersonate the vulnerable domain to any XMPP domain whose domain name includes the attackers domain as a suffix. For example, bber.example would be able to connect to jabber.example an...

DLA-407-1 prosody - security update

Bulletin has no description...

CVE-2016-0756

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...

CVE-2016-0756

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...

Design/Logic Flaw

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...

CVE-2016-0756

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...

CVE-2016-0756

The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...

CVE-2016-0756

The CVE-2016-0756 issue affects Prosody’s mod_dialback, where the generate_dialback function in versions prior to 0.9.10 failed to properly distinguish fields when generating a dialback key. This allows a remote attacker to spoof an XMPP network domain by crafting a stream ID and embedding the do...