JA
Product
Jabberd2
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 1Low 0
Watch
Add Jabberd2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-10807 | 9.8 | Jul 4 | JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled Affected: through 2.6.0 |
| CVE-2017-18225 | 7.8 | Mar 12 | The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which… Affected: through 2.6.1 |
| CVE-2011-1755 | 7.5 | Jun 21 | jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a… Affected: before 2.2.14 |
| CVE-2017-18226 | 5.5 | Mar 12 | The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by… Affected: through 2.6.1 |
| CVE-2015-2058 | – | Aug 12 | c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or… Affected: through 2.3.2 |
| CVE-2012-3525 | – | Aug 25 | s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1)… Affected: through 2.2.16; 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; +34 more |
Showing 6