53 matches found
EUVD-2022-4192
Malicious code in bioql PyPI...
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and...
CVE-2020-26547
Monal
CVE-2020-26547
Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon XEP-0280 results. This allows a remote attacker able to send stanzas to a victim to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim...
User Impersonation in converse.js
Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280: Message Carbons that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display...
GHSA-W973-2QCC-P78X User Impersonation in converse.js
Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280: Message Carbons that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display...
CVE-2019-16235
Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280messagecarbons.vala...
Code injection
Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280messagecarbons.vala...
UBUNTU-CVE-2019-16235
Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280messagecarbons.vala...
[slackware-security] mcabber
New mcabber packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mcabber-1.0.5-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: An incorrect implementation of XEP-028...
Updated jitsi packages fix security vulnerability
An incorrect implementation of XEP-0280: Message Carbons in Jitsi and other XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks CVE-2017-5603...
Social Engineering Attack Via Impersonation
slixmpp and sleekxmpp are vulnerable to social engineering attacks via a loophole leading to impersonation. It happens due to a flaw in the implementation of XEP-0280: Message Carbons in multiple XMPP clients, allowing a malicious user to impersonate any user, including contacts in the vulnerable...
Social Engineering Attacks Via Impersonation
converse.js is vulnerable to various social engineering attacks via a loophole leading to impersonation. It can happen due to a flaw in implementation of XEP-0280: Message Carbons in multiple XMPP clients, allowing malicious user to impersonate any user, including contacts, in the vulnerable...
XMPP Clients User Impersonation Vulnerability
Exploit for multiple platform in category local exploits Multiple XMPP Clients User Impersonation Vulnerability Summary ------- An incorrect implementation of XEP-0280: Message Carbons0 in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerabl...
mcabber user emulation vulnerability
mcabber is an XMPP Jabber console client. A user emulation vulnerability exists in mcabber. The vulnerability exists because the program fails to properly implement "XEP-0280: Message Carbons". A remote attacker can exploit this vulnerability to impersonate an arbitrary user...
Design/Logic Flaw
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ 0.16.563.580 -...
Design/Logic Flaw
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and...
CVE-2017-5858
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js 0.8.0 - 1.0.6...
CVE-2017-5589
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno 0.8.6 -...
Design/Logic Flaw
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno 0.8.6 -...