CVE-2018-15721

The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API...

CVE-2018-15720

Affected product: Logitech Harmony Hub. Vulnerability: hard-coded XMPP accounts in the hub’s XMPP server allow remote, unauthenticated access to the local API. Root cause: exposed credentials baked into the firmware prior to 4.15.206. Impact: potential remote control of the hub APIs; effect on co...

CVE-2018-15720

Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API...

[SECURITY] Fedora 26 Update: ejabberd-17.01-3.fc26

ejabberd is a Free and Open Source distributed fault-tolerant Jabber/XMPP server. It is mostly written in Erlang, and runs on many platforms tested on Linux, FreeBSD, NetBSD, Solaris, Mac OS X and Windows NT/2000/XP...

Design/Logic Flaw

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

Debian: Security Advisory (DSA-3463-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3463-1 (prosody - security update)

It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server. OpenVAS Vulnerability Test $Id: deb3463.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3463-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbo...

[SECURITY] [DSA 3463-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3463-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 31, 2016 https://www.debian.org/security/faq -...

DSA-3463-1 prosody - security update

Bulletin has no description...

CVE-2014-9757: Deserialisation Through Smack Resulting in Remote Code Execution Vulnerability

Bamboo used an old version of the Smack XMPP library that deserialises messages received from XMPP. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Bamboo if a XMPP connection has been configured. To exploit this issue, Bamboo...

Incorrect handling of self signed certificates in OpenFire XMPP Server

Incorrect handling of self signed certificates in OpenFire XMPP Server Affected software: OpenFire XMPP server Affected versions: 3.9.3 and earlier Vulnerabilities addressed: CVE-2014-3451, CVE-2015-2080 Openfire is a real time collaboration RTC server licensed under the Open Source Apache Licens...

Debian Security Advisory DSA 2895-1 (prosody - security update)

A denial-of-service vulnerability has been reported in Prosody, a XMPP server. If compression is enabled, an attacker might send highly-compressed XML elements attack known as zip bomb over XMPP streams and consume all the resources of the server. The SAX XML parser lua-expat is also affected by...

DSA-2895-1 prosody - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2895-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2775-1 (ejabberd - insecure SSL usage)

It was discovered that ejabberd, a Jabber/XMPP server, uses SSLv2 and weak ciphers for communication, which are considered insecure. The software offers no runtime configuration options to disable these. This update disables the use of SSLv2 and weak ciphers. The updated package for Debian 7 whee...

RHEL 5 : jabberd (RHSA-2011:0882)

An updated jabberd package that fixes one security issue is now available for Red Hat Network Satellite 5.4.1 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives ...

RHEL 6 : Red Hat Network Proxy server jabberd (RHSA-2012:1539)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1539 advisory. This package provides jabberd 2, an Extensible Messaging and Presence Protocol XMPP server used for XML based communication. It was discovered that t...

Mac OS X : OS X Server < 2.1.1 Multiple Vulnerabilities

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.1.1. It is, therefore, affected by the following vulnerabilities : - When the xml2 contrib module is enabled in PostgreSQL, an unprivileged database user can read or write arbitrary files, subject to the...

Fedora 18 : jabberd-2.2.17-1.fc18 (2012-12418)

included patch for 'Vulnerability in XMPP Server Dialback Implementations' http://xmpp.org/resources/security-notices/server-dialback/ fix for systemd scripts Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...