CVSS: 7.8EPSS: 1%CPEs: 5EXPL: 0CVE-2014-2742
https://notcve.org/view.php?id=CVE-2014-2742
Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. Isode M-Link anterior a 16.0v7 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una cadena XMPP manipulada, también conocido como un ataque "xmppbomb". • http://openwall.com/lists/oss-security/2014/04/07/7 http://openwall.com/lists/oss-security/2014/04/09/1 http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4669
https://notcve.org/view.php?id=CVE-2012-4669
M-Link R14.6 before R14.6v14 and R15.1 before R15.1v10 does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted. M-Link R14.6 antes de R14.6v14 y R15.1 antes de R15.1v10 no comprueba que se presente una solicitud para una respuesta XMPP Server Dialback, lo que permite a servidores remotos de XMPP falsificar dominios a través de las respuestas de dominios no confirmados. • http://isode.com/company/wordpress/xmpp-server-dialback http://xmpp.org/resources/security-notices/server-dialback • CWE-20: Improper Input Validation •