PR
Product
Prosody
21
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 10Medium 6Low 0
Watch
Add Prosody to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10847 | 8.8 | Jul 30 | prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass Affected: before 0.9.14; 0.10.0; 0.10.1 |
| CVE-2026-43507 | 7.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 Affected: before 0.12.6; 1.0.0 before 13.0.5 |
| CVE-2026-43506 | 7.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 Affected: before 0.12.6; 1.0.0 before 13.0.5 |
| CVE-2022-0217 | 7.5 | Aug 26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data Affected: before 0.11.12 |
| CVE-2021-37601 | 7.5 | Jul 30 | muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat… Affected: 0.11.0 through 0.11.9 |
| CVE-2021-32920 | 7.5 | May 13 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests Affected: before 0.11.9 |
| CVE-2021-32919 | 7.5 | May 13 | An issue was discovered in Prosody before 0.11.9 Affected: 0.10.0 before 0.11.9 |
| CVE-2021-32918 | 7.5 | May 13 | An issue was discovered in Prosody before 0.11.9 Affected: before 0.11.9 |
| CVE-2017-18265 | 7.5 | May 9 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such… Affected: before 0.10.0 |
| CVE-2016-1232 | 7.5 | Jan 12 | The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier… Affected: through 0.9.8; 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; +3 more |
| CVE-2026-43505 | 6.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled Affected: before 0.12.6; 1.0.0 before 13.0.5 |
| CVE-2026-43504 | 6.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled Affected: before 0.12.6; 1.0.0 before 13.0.5 |
| CVE-2021-32921 | 5.9 | May 13 | An issue was discovered in Prosody before 0.11.9 Affected: before 0.11.9 |
| CVE-2016-1231 | 5.9 | Jan 12 | Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a Affected: 0.9.0; 0.9.1; 0.9.2; 0.9.3; 0.9.4; 0.9.5; +3 more |
| CVE-2021-32917 | 5.3 | May 13 | An issue was discovered in Prosody before 0.11.9 Affected: before 0.11.9 |
| CVE-2016-0756 | 5.3 | Jan 29 | The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers… Affected: through 0.9.9 |
| CVE-2014-2745 | – | Apr 11 | Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a… Affected: through 0.9.3; 0.1.0; 0.2.0; 0.3.0; 0.4.0; 0.4.1; +14 more |
| CVE-2014-2744 | – | Apr 11 | plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows… Affected: through 0.9.3; 0.1.0; 0.2.0; 0.3.0; 0.4.0; 0.4.1; +14 more |
| CVE-2011-2532 | – | Jun 22 | The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as… Affected: 0.8.0 |
| CVE-2011-2531 | – | Jun 22 | Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of… Affected: 0.8.0 |
| CVE-2011-2205 | – | Jun 22 | Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a… Affected: through 0.8.0; 0.1.0; 0.2.0; 0.3.0; 0.4.0; 0.4.1; +10 more |
Showing 21