mellium records
3 published records for vendor mellium.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-287 Improper Authentication1
- CWE-290 Authentication Bypass by Spoofing1
- CWE-295 Improper Certificate Validation1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
39Monitor | CVE-2022-48195No exploit | An issue was discovered in Mellium mellium.im/sasl before 0.3.1.mellium · sasl · CWE-287 | Critical9.8 | 0.9%Dec 30, 2022 |
39Monitor | CVE-2024-46957No exploit | Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is CWE-290 | Critical9.8 | 0.6%Sep 24, 2024 |
23Monitor | CVE-2022-24968No exploit | In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a mellium · xmpp · CWE-295 | Medium5.9 | 0.5%Feb 11, 2022 |
- CVE-2022-4819539Monitor
An issue was discovered in Mellium mellium.im/sasl before 0.3.1.
CriticalCVSS 9.8No exploitEPSS 0%mellium · saslDec 30, 2022
- CVE-2024-4695739Monitor
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is
CriticalCVSS 9.8No exploitEPSS 0%Sep 24, 2024
- CVE-2022-2496823Monitor
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a
MediumCVSS 5.9No exploitEPSS 0%mellium · xmppFeb 11, 2022