CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2743
https://notcve.org/view.php?id=CVE-2014-2743
11 Apr 2014 — plugins/mod_compression.lua in Lightwitch Metronome through 3.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. plugins/mod_compression.lua en Lightwitch Metronome hasta 3.4 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una ca... • http://code.lightwitch.org/metronome/rev/49f47277a411 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 2%CPEs: 21EXPL: 2CVE-2014-2744 – Debian Security Advisory 2895-2
https://notcve.org/view.php?id=CVE-2014-2744
11 Apr 2014 — plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack. plugins/mod_compression.lua en (1) Prosody anterior a 0.9.4 y (2) Lightwitch Metronome hasta 3.4 negocia compresión de cadena mientras una sesión no está autenticada, lo que permite a atacantes ... • http://blog.prosody.im/prosody-0-9-4-released • CWE-20: Improper Input Validation •