Vulnerabilities > Prosody > Prosody
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-26 | CVE-2022-0217 | XML Entity Expansion vulnerability in Prosody It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. | 7.5 |
| 2021-07-30 | CVE-2021-37601 | Unspecified vulnerability in Prosody muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations. | 7.5 |
| 2021-05-13 | CVE-2021-32917 | Missing Authorization vulnerability in multiple products An issue was discovered in Prosody before 0.11.9. | 5.3 |
| 2021-05-13 | CVE-2021-32918 | Resource Exhaustion vulnerability in multiple products An issue was discovered in Prosody before 0.11.9. | 7.5 |
| 2021-05-13 | CVE-2021-32919 | Improper Certificate Validation vulnerability in multiple products An issue was discovered in Prosody before 0.11.9. | 7.5 |
| 2021-05-13 | CVE-2021-32920 | Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. | 7.5 |
| 2021-05-13 | CVE-2021-32921 | Race Condition vulnerability in multiple products An issue was discovered in Prosody before 0.11.9. | 5.9 |
| 2018-07-30 | CVE-2018-10847 | Improper Authentication vulnerability in Prosody prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. | 6.5 |
| 2018-05-09 | CVE-2017-18265 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch. | 5.0 |
| 2016-01-29 | CVE-2016-0756 | Improper Input Validation vulnerability in Prosody The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix. | 5.0 |