Approved changes feed: RSS · Atom
cpe:2.3:a:jabberd2:jabberd2:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Jabberd2 (16576d0a-6b76-56c9-bc72-48a89df70b8d) |
|---|---|
| Product | Jabberd2 (5c0c3d42-9905-5bee-8ee1-88fa4e7f0083) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/jabberd2 |
purl2cpe | 2026-06-01 10:11:07.364279 |
pkg:deb/ubuntu/jabberd2 |
purl2cpe | 2026-06-01 10:11:07.364282 |
pkg:github/jabberd2/jabberd2 |
purl2cpe | 2026-06-01 10:11:07.364284 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-18226 |
vulnerable | 2026-06-08 05:09:10.607654 |
Details available
The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM `cat /var/run/jabber/filename.pid`" command.
Published: 2018-03-12T04:00:00.000Z
Updated: 2024-08-05T21:13:49.150Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18225 |
vulnerable | 2026-06-08 05:09:10.606622 |
Details available
The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.
Published: 2018-03-12T04:00:00.000Z
Updated: 2024-08-05T21:13:49.096Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-10807 |
vulnerable | 2026-06-08 05:08:36.319886 |
Details available
JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Published: 2017-07-04T15:00:00.000Z
Updated: 2024-08-05T17:50:11.702Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2058 |
vulnerable | 2026-06-08 05:06:27.376863 |
Details available
c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Published: 2015-08-12T14:00:00.000Z
Updated: 2024-08-06T05:02:43.361Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-3525 |
vulnerable | 2026-06-08 05:02:10.496826 |
Details available
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Published: 2012-08-25T16:00:00.000Z
Updated: 2024-08-06T20:05:12.865Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-1755 |
vulnerable | 2026-06-08 04:58:01.909954 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.