Vulnerabilities > Prosody > Prosody > 0.3.0

DATE CVE VULNERABILITY TITLE RISK
2022-08-26 CVE-2022-0217 XML Entity Expansion vulnerability in Prosody
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data.
network
low complexity
prosody CWE-776
7.5
7.5
2021-05-13 CVE-2021-32917 Missing Authorization vulnerability in multiple products
An issue was discovered in Prosody before 0.11.9.
network
low complexity
prosody debian fedoraproject CWE-862
5.3
5.3
2021-05-13 CVE-2021-32918 Resource Exhaustion vulnerability in multiple products
An issue was discovered in Prosody before 0.11.9.
network
low complexity
prosody debian fedoraproject CWE-400
7.5
7.5
2021-05-13 CVE-2021-32920 Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
network
low complexity
prosody debian fedoraproject
7.5
7.5
2021-05-13 CVE-2021-32921 Race Condition vulnerability in multiple products
An issue was discovered in Prosody before 0.11.9.
network
high complexity
prosody fedoraproject debian CWE-362
5.9
5.9
2018-07-30 CVE-2018-10847 Improper Authentication vulnerability in Prosody
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass.
network
low complexity
prosody CWE-287
8.8
8.8
2018-05-09 CVE-2017-18265 Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaSocket library, such as the lua-socket package from Debian stretch.
network
low complexity
prosody debian
7.5
7.5
2016-01-29 CVE-2016-0756 Improper Input Validation vulnerability in Prosody
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.
network
low complexity
prosody CWE-20
5.3
5.3
2016-01-12 CVE-2016-1232 The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
network
low complexity
prosody fedoraproject debian
7.5
7.5