21 results · Feed
-
Medium 5.3
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur …
-
Medium 5.3
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. A Denial of Service can occur …
-
Medium 6.5
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. B…
-
Medium 6.5
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. B…
-
Unscored —
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML fea…
-
High 7.5
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, m…
-
Unscored —
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secre…
-
Unscored —
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
-
Unscored —
An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback ena…
-
Unscored —
An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-…
-
Unscored —
An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither …
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
Unscored —
Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompati…
-
Unscored —
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields wh…
-
Unscored —
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for serve…
-
Unscored —
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows…
-
Unscored —
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream comp…
-
Unscored —
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attacker…
-
Unscored —
Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, w…
-
Unscored —
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause…
-
Unscored —
The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial …