[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feDREIElSP55g3s9En2JwjbgycaePsTVe3iAD4jhcYCM":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":29,"kevVulnerabilities":86,"topProductsByCves":87,"seoMetadata":91,"meta":100},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":28},25739,"prosody",3,18,0,56,"2022-08-26","p",[16,20,25],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},130927,54,17,{"id":21,"product_name":22,"version_count":23,"cve_count":23,"kev_count":11,"last_cve_update":24},130925,"mod_auth_ldap",1,"2020-01-28",{"id":26,"product_name":27,"version_count":23,"cve_count":23,"kev_count":11,"last_cve_update":24},130926,"mod_auth_ldap2","Prosody is a technology vendor with 3 tracked products and 18 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[30,38,45,49,57,62,67,71,76,80],{"cveId":31,"description":32,"publishedDate":13,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":36,"epssScore":37},"CVE-2022-0217","It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).",7.5,"v3.1","High",false,0.0541,{"cveId":39,"description":40,"publishedDate":41,"cvssScore":42,"cvssVersion":43,"severity":35,"isKev":36,"epssScore":44},"CVE-2014-2744","plugins\u002Fmod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an \"xmppbomb\" attack.","2014-04-11",7.8,"v2",0.03313,{"cveId":46,"description":47,"publishedDate":41,"cvssScore":42,"cvssVersion":43,"severity":35,"isKev":36,"epssScore":48},"CVE-2014-2745","Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an \"xmppbomb\" attack, related to core\u002Fportmanager.lua and util\u002Fxmppstream.lua.",0.03141,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":53,"cvssVersion":54,"severity":55,"isKev":36,"epssScore":56},"CVE-2016-1231","Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.","2016-01-12",5.9,"v3.0","Medium",0.02867,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":36,"epssScore":61},"CVE-2021-37601","muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.","2021-07-30",0.02329,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":36,"epssScore":66},"CVE-2021-32920","Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL\u002FTLS renegotiation requests.","2021-05-13",0.02261,{"cveId":68,"description":69,"publishedDate":52,"cvssScore":33,"cvssVersion":54,"severity":35,"isKev":36,"epssScore":70},"CVE-2016-1232","The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.",0.02183,{"cveId":72,"description":73,"publishedDate":65,"cvssScore":74,"cvssVersion":34,"severity":55,"isKev":36,"epssScore":75},"CVE-2021-32917","An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.",5.3,0.0216,{"cveId":77,"description":78,"publishedDate":65,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":36,"epssScore":79},"CVE-2021-32918","An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3.",0.02115,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":84,"cvssVersion":43,"severity":55,"isKev":36,"epssScore":85},"CVE-2011-2205","Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.","2011-06-22",5,0.02069,[],[88,89,90],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":23,"kev_count":11,"last_cve_update":24},{"id":26,"product_name":27,"version_count":23,"cve_count":23,"kev_count":11,"last_cve_update":24},{"title":92,"metaDescription":93,"keywords":94,"structuredData":95},"Prosody - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Prosody covering 3 products with 18 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Prosody vulnerabilities, Prosody security, Prosody CVE, Prosody threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":96,"@type":97,"name":98,"description":93,"url":99},"https:\u002F\u002Fschema.org","Organization","Prosody","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fprosody",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":101,"apiVersion":102},"2026-10-18T21:41:59.840Z","3.0"]