Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

jabberd2 jabberd2 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2012-3525
s2s/out.c in jabberd2 2.2.16 and previous versions does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Jabberd2 Jabberd2 2.1.2Jabberd2 Jabberd2 2.1.9Jabberd2 Jabberd2 2.1.23Jabberd2 Jabberd2 2.2.7.1Jabberd2 Jabberd2 2.1.1Jabberd2 Jabberd2 2.1.5Jabberd2 Jabberd2 2.2.10Jabberd2 Jabberd2 2.2.0Jabberd2 Jabberd2 2.1.8Jabberd2 Jabberd2 2.2.2Jabberd2 Jabberd2 2.1.12Jabberd2 Jabberd2 2.2.8Jabberd2 Jabberd2 2.1.18Jabberd2 Jabberd2 2.1.22Jabberd2 Jabberd2Jabberd2 Jabberd2 2.2.7Jabberd2 Jabberd2 2.2.5Jabberd2 Jabberd2 2.2.13Jabberd2 Jabberd2 2.1.10Jabberd2 Jabberd2 2.1Jabberd2 Jabberd2 2.1.15Jabberd2 Jabberd2 2.2.15
NA
CVE-2015-2058
c2s/c2s.c in Jabber Open Source Server 2.3.2 and previous versions truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Jabberd2 Jabberd2
9.8
CVSSv3
CVE-2017-10807
JabberD 2.x (aka jabberd2) prior to 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Jabberd2 Jabberd2
7.8
CVSSv3
CVE-2017-18225
The Gentoo net-im/jabberd2 package up to and including 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then wait...
Jabberd2 Jabberd2
5.5
CVSSv3
CVE-2017-18226
The Gentoo net-im/jabberd2 package up to and including 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "...
Jabberd2 Jabberd2
7.5
CVSSv3
CVE-2011-1755
jabberd2 prior to 2.2.14 does not properly detect recursion during entity expansion, which allows remote malicious users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to ...
Jabberd2 Jabberd2Fedoraproject Fedora 13Fedoraproject Fedora 15Fedoraproject Fedora 14Apple Mac Os X ServerApple Mac Os X
NA
CVE-2015-2059
The stringprep_utf8_to_ucs4 function in libin prior to 1.31, as used in jabberd2, allows context-dependent malicious users to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.
Gnu LibidnOpensuse Opensuse 13.2Opensuse Opensuse 13.1Fedoraproject Fedora 21Fedoraproject Fedora 22
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook