1261 matches found
DLA-407-1 prosody - security update
Bulletin has no description...
CVE-2016-0756
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
CVE-2016-0756
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
Design/Logic Flaw
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
CVE-2016-0756
The CVE-2016-0756 issue affects Prosody’s mod_dialback, where the generate_dialback function in versions prior to 0.9.10 failed to properly distinguish fields when generating a dialback key. This allows a remote attacker to spoof an XMPP network domain by crafting a stream ID and embedding the do...
CVE-2016-0756
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
CVE-2016-0756
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
CVE-2016-0756
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
PT-2016-4403
Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.10 Description The issue arises from the generate dialback function in the mod dialback module, which fails to properly separate fields when generating dialback keys. This allows remote attackers to spoof XMPP...
CVE-2016-0756: Improper Input Validation
The generatedialback function in the moddialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix...
[SECURITY] Fedora 22 Update: prosody-0.9.9-2.fc22
Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...
[SECURITY] Fedora 23 Update: prosody-0.9.9-2.fc23
Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...
[SECURITY] [DLA 391-1] prosody security update
Package : prosody Version : 0.7.0-1squeeze1+deb6u1 CVE ID : CVE-2016-1232 It was discovered that in prosody, a Lightweight Jabber/XMPP server, used a weak PRNG in the moddialback module. For Debian 6 Squeeze, this issue has been fixed in prosody version 0.7.0-1squeeze1+deb6u1. Regards, - -- ,. : ...
DLA-391-1 prosody - security update
Bulletin has no description...
Cisco Jabber for Windows 8.x / 9.x / 10.x / 11.0.x / 11.1.x XMPP Connection MitM STARTTLS Downgrade (cisco-sa-20151224-jab)
The version of Cisco Jabber for Windows installed on the remote host is 8.x, 9.x, 10.x, 11.0.x, or 11.1.x prior to 11.5. It is, therefore, affected by man-in-the-middle STARTTLS downgrade vulnerability due to improper checks to ensure the Extensible Messaging and Presence Protocol XMPP connection...
[SECURITY] Fedora 22 Update: gajim-0.16.5-1.fc22
Gajim is a Jabber client written in PyGTK. The goal of Gajim's developers is to provide a full featured and easy to use xmpp client for the GTK+ users. Gajim does not require GNOME to run, even though it exists with it nicely...
[SECURITY] Fedora 23 Update: gajim-0.16.5-1.fc23
Gajim is a Jabber client written in PyGTK. The goal of Gajim's developers is to provide a full featured and easy to use xmpp client for the GTK+ users. Gajim does not require GNOME to run, even though it exists with it nicely...
Cisco Jabbar chat client vulnerability to man in the middle attacks-vulnerability warning-the black bar safety net
Cisco released an official announcement that its chat clients Jabbar in the presence of security vulnerabilities, vulnerable to a middleman attack. The vulnerability exists on the Windows platform-Jabbar, an unauthorized remote attacker can exploit the vulnerability to implement STARTTLS downgrad...
CVE-2014-9757: Deserialisation Through Smack Resulting in Remote Code Execution Vulnerability
Bamboo used an old version of the Smack XMPP library that deserialises messages received from XMPP. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo if a XMPP connection has been configured. To exploit this issue, Bamboo...
CVE-2014-9757: Deserialisation Through Smack Resulting in Remote Code Execution Vulnerability
Bamboo used an old version of the Smack XMPP library that deserialises messages received from XMPP. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo if a XMPP connection has been configured. To exploit this issue, Bamboo...