Export limit exceeded: 425758 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2016-10027

smack: TLS SecurityMode.required bypass via StripTLS attack

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.

CVSS 3.1 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Igniterealtime
Products
Fedora Smack
CVE-2014-0363

smack: incorrect X.509 certificate validation

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Igniterealtime Redhat
Products
Smack Jboss Bpms Jboss Brms and 1 more
CVE-2014-0364

smack: IQ response spoofing

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed
Vendors
Igniterealtime Redhat
Products
Smack Jboss Bpms Jboss Brms and 1 more
CVE-2014-5075

smack: MitM vulnerability

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Igniterealtime Redhat
Products
Smack Api Jboss Fuse