Vulnerabilities > Jabberd2

DATE CVE VULNERABILITY TITLE RISK
2018-03-12 CVE-2017-18226 Incorrect Permission Assignment for Critical Resource vulnerability in Jabberd2
The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM `cat /var/run/jabber/filename.pid`" command.
local
low complexity
jabberd2 gentoo CWE-732
2.1
2018-03-12 CVE-2017-18225 Incorrect Permission Assignment for Critical Resource vulnerability in Jabberd2
The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.
local
low complexity
jabberd2 gentoo CWE-732
4.6
2017-07-04 CVE-2017-10807 Improper Authentication vulnerability in Jabberd2
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
network
low complexity
jabberd2 CWE-287
7.5
2015-08-12 CVE-2015-2058 Information Exposure vulnerability in Jabberd2
c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
network
low complexity
jabberd2 CWE-200
6.5
2011-06-21 CVE-2011-1755 XML Entity Expansion vulnerability in multiple products
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
network
low complexity
jabberd2 fedoraproject apple CWE-776
7.5