slixmpp project vulnerabilities

Products

• slixmpp 3

Latest slixmpp project CVEs

Newest publication first

1. CVE-2022-45197 Slixmpp lacks SSL Certificate hostname validation in XMLStream

   Published 2022-12-25

   High·CVSS 7.5 EPSS 0.51%

   Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.

2. CVE-2019-1000021 slixmpp Incorrect Access Control

   Published 2019-02-04

   High·CVSS 7.5 EPSS 2.3%

   slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all...

3. CVE-2017-5591 SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

   Published 2017-02-09

   Medium·CVSS 5.9 EPSS 1.7%

   An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMP...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.