Code injection

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

Design/Logic Flaw

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2531

Prosody 0.8.x before 0.8.1 is affected when using MySQL, where an incorrect data type is assigned to the value column in certain tables. This mismatch can allow remote attackers to trigger a denial of service (data truncation) by sending a large amount of data. The issue is rooted in how the valu...

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2205

CVE-2011-2205 affects Prosody prior to version 0.8.1, where recursion during entity expansion is not properly detected. A crafted XML with a large number of nested entity references can cause a remote denial-of-service (memory and CPU consumption), a vulnerability related to CVE-2003-1564. The en...

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

CVE-2011-2531

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532

Prosody 0.8.x before 0.8.1 is affected by a denial-of-service issue in json.decode (util/json.lua) triggered by invalid JSON data, e.g., truncated input. The vulnerability allows remote attackers to cause an infinite loop. Remediation is upgrading to Prosody 0.8.1 (as per the 0.8.1 release notes)...

PT-2011-3918

Name of the Vulnerable Software and Affected Versions Prosody versions 0.8.x before 0.8.1 Description The issue arises when MySQL is used, and an incorrect data type is assigned to the value column in certain tables. This might allow remote attackers to cause a denial of service, specifically dat...

CVE-2011-2205: Undefined Security Weakness

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

PT-2011-3681

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.8.1 Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved through a crafted XML document containing a large number of nested entity references...

CVE-2011-2531: Undefined Security Weakness

Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service data truncation by sending a large amount of data...

CVE-2011-2532: Undefined Security Weakness

The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service infinite loop via invalid JSON data, as demonstrated by truncated data...

PT-2011-3919

Name of the Vulnerable Software and Affected Versions Prosody versions 0.8.0 through 0.8.1 Description The issue is related to the json.decode function in util/json.lua, which might allow remote attackers to cause a denial of service infinite loop via invalid JSON data. This can be demonstrated b...