Skip to content

Product

debian/lua-expat vulnerabilities

2 published CVES affecting debian/lua-expat, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest debian/lua-expat CVEs

Newest publication first

  1. CVE-2014-2744 plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to caus...

    Published
    HighCVSS 7.8

    plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an X...

  2. CVE-2011-2188 LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document con...

    Published
    MediumCVSS 5.0

    LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.