PR
Vendor
Prosody
23
CVEs
0
On KEV
0
New 30D
Products
PR8.8
Prosody
Prosody
21 CVEs0 on KEV0 new
MA9.8
Mod Auth Ldap
Prosody
1 CVEs0 on KEV0 new
MA9.8
Mod Auth Ldap2
Prosody
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-43507 | PR Prosody Prosody | 7.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 |
| CVE-2026-43506 | PR Prosody Prosody | 7.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 |
| CVE-2026-43505 | PR Prosody Prosody | 6.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled |
| CVE-2026-43504 | PR Prosody Prosody | 6.5 | May 1 | An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled |
| CVE-2022-0217 | PR Prosody Prosody | 7.5 | Aug 26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data |
| CVE-2021-37601 | PR Prosody Prosody | 7.5 | Jul 30 | muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat… |
| CVE-2021-32921 | PR Prosody Prosody | 5.9 | May 13 | An issue was discovered in Prosody before 0.11.9 |
| CVE-2021-32920 | PR Prosody Prosody | 7.5 | May 13 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests |
| CVE-2021-32919 | PR Prosody Prosody | 7.5 | May 13 | An issue was discovered in Prosody before 0.11.9 |
| CVE-2021-32918 | PR Prosody Prosody | 7.5 | May 13 | An issue was discovered in Prosody before 0.11.9 |
| CVE-2021-32917 | PR Prosody Prosody | 5.3 | May 13 | An issue was discovered in Prosody before 0.11.9 |
| CVE-2020-8086 | MA Mod Auth Ldap Prosody | 9.8 | Jan 28 | The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function |
| CVE-2018-10847 | PR Prosody Prosody | 8.8 | Jul 30 | prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass |
| CVE-2017-18265 | PR Prosody Prosody | 7.5 | May 9 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such… |
| CVE-2016-0756 | PR Prosody Prosody | 5.3 | Jan 29 | The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers… |
| CVE-2016-1232 | PR Prosody Prosody | 7.5 | Jan 12 | The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier… |
| CVE-2016-1231 | PR Prosody Prosody | 5.9 | Jan 12 | Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a |
| CVE-2014-2745 | PR Prosody Prosody | – | Apr 11 | Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a… |
| CVE-2014-2744 | PR Prosody Prosody | – | Apr 11 | plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows… |
| CVE-2011-2532 | PR Prosody Prosody | – | Jun 22 | The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as… |
| CVE-2011-2531 | PR Prosody Prosody | – | Jun 22 | Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of… |
| CVE-2011-2205 | PR Prosody Prosody | – | Jun 22 | Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a… |