35 matches found
SUSE CVE-2026-113867
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
DEBIAN-CVE-2026-113867
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...
CVE-2026-113867
The Thunderbird chat feature with XMPP accounts is vulnerable to a stanza injection flaw. The root cause is the failure to escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests are echoed in automatic replies, a remote XMPP user can send a crafted r...
PT-2026-119605
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap file key. The header parser accepts any number of recipient stanzas, and unwrap file key tries every identity against every X25519...
PT-2026-118619
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.5.1 Thunderbird versions prior to 158.0.1 Description Thunderbird fails to escape attribute values when serializing outgoing XMPP stanzas. Since values from incoming requests are echoed back in automatic...
Mozilla Thunderbird security vulnerabilities
Versions of Mozilla Thunderbird prior to 158.0.1 and 153.5.1 have a security vulnerability. This vulnerability stems from the lack of escaping of attribute values during the serialization of outbound XMPP stanzas. Values passed in incoming requests are also passed back automatically. A remote XMP...
EUVD-2022-42280
Malicious code in bioql PyPI...
Spotlight server-side Share Path Disclosure
Description As part of the Spotlight protocol, the initial request returns a path associated with the sharename targeted by the RPC request. Samba returns the real server-side share path at this point, as well as returning the absolute server-side path of results in search queries by clients. Kno...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
Design/Logic Flaw
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
UBUNTU-CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
CVE-2022-39835: Improper Access Control
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...
PT-2022-7426 · Gajim +3 · Gajim +3
Name of the Vulnerable Software and Affected Versions: Gajim versions 1.4.7 and earlier Description: The issue allows attackers to correct messages that were not sent by them via crafted XML stanzas. The attacker needs to be part of the group chat or single chat. This can potentially impact the...
Tigase XMPP Server Stanza Smuggling
Tigase XMPP server: XMPP stanza smuggling via unescaped qutes Tigase XMPP server suffers from a security vulnerability due to not escaping double quote character when serializing parsed XML. This can be used to "smuggle" or, if you prefer, inject arbitrary attacker-controlled stanza in the XMPP...
feedparser Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas...