Prosody vulnerabilitiesNone on the known-exploited list.
Prosody has 18 published vulnerabilities across 3 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Prosody, with 17. If you run Prosody software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Prosody products have the most vulnerabilities?
Prosody leads with 17 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Prosody vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Prosody's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Prosody flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 5.4%CVE-2022-0217High
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data.
- 3.3%CVE-2014-2744High
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of...
- 3.1%CVE-2014-2745High
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an...
- 2.9%CVE-2016-1231Medium
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a ..
- 2.3%CVE-2021-37601High
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
- 2.3%CVE-2021-32920High
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
- 2.2%CVE-2016-1232High
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a...
- 2.2%CVE-2021-32917Medium
An issue was discovered in Prosody before 0.11.9.
- 2.1%CVE-2021-32918High
An issue was discovered in Prosody before 0.11.9.
- 2.1%CVE-2011-2205Medium
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large...
All Prosody products we track.
3 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
Running Prosody? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
- Matched to
- Prosody on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 18 published vulnerabilities across 3 products and 56 versions from Prosody.
None of Prosody's vulnerabilities is on the list of flaws known to be exploited today.
Prosody, with 17 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Prosody products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.