Skip to content
Noroxi

Prosody records

22 published records for vendor prosody.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 21
  4. 22
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

22 records
  • CVE-2020-8086
    39Monitor

    The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_

    CriticalCVSS 9.8No exploitEPSS 1%

    prosody · mod auth ldapJan 28, 2020

  • CVE-2018-10847
    35Monitor

    prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass.

    HighCVSS 8.8No exploitEPSS 1%

    prosody · prosodyJul 30, 2018

  • CVE-2022-0217
    32Monitor

    It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in pars

    HighCVSS 7.5No exploitEPSS 5%

    prosody · prosodyAug 26, 2022

  • CVE-2014-2744
    32Monitor

    plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a sessi

    HighCVSS 7.8No exploitEPSS 3%

    lightwitch · metronomeApr 10, 2014

  • CVE-2014-2745
    32Monitor

    Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial o

    HighCVSS 7.8No exploitEPSS 3%

    prosody · prosodyApr 10, 2014

  • CVE-2021-37601
    31Monitor

    muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and b

    HighCVSS 7.5No exploitEPSS 2%

    prosody · prosodyJul 30, 2021

  • CVE-2021-32920
    31Monitor

    Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.

    HighCVSS 7.5No exploitEPSS 2%

    prosody · prosodyMay 13, 2021

  • CVE-2016-1232
    31Monitor

    The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback

    HighCVSS 7.5No exploitEPSS 2%

    prosody · prosodyJan 12, 2016

  • CVE-2021-32918
    31Monitor

    An issue was discovered in Prosody before 0.11.9.

    HighCVSS 7.5No exploitEPSS 2%

    prosody · prosodyMay 13, 2021

  • CVE-2017-18265
    31Monitor

    Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain v

    HighCVSS 7.5No exploitEPSS 1%

    prosody · prosodyMay 9, 2018

  • CVE-2021-32919
    30Monitor

    An issue was discovered in Prosody before 0.11.9.

    HighCVSS 7.5No exploitEPSS 1%

    prosody · prosodyMay 13, 2021

  • CVE-2026-43507
    30Monitor

    An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.

    HighCVSS 7.5No exploitEPSS 0%

    prosody · prosodyMay 1, 2026

  • CVE-2026-43506
    30Monitor

    An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5.

    HighCVSS 7.5No exploitEPSS 0%

    prosody · prosodyMay 1, 2026

  • CVE-2026-43504
    26Monitor

    An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled.

    MediumCVSS 6.5No exploitEPSS 0%

    prosody · prosodyMay 1, 2026

  • CVE-2026-43505
    26Monitor

    An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled.

    MediumCVSS 6.5No exploitEPSS 0%

    prosody · prosodyMay 1, 2026

  • CVE-2016-1231
    24Monitor

    Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to

    MediumCVSS 5.9No exploitEPSS 2%

    prosody · prosodyJan 12, 2016

  • CVE-2021-32921
    23Monitor

    An issue was discovered in Prosody before 0.11.9.

    MediumCVSS 5.9No exploitEPSS 1%

    prosody · prosodyMay 13, 2021

  • CVE-2021-32917
    22Monitor

    An issue was discovered in Prosody before 0.11.9.

    MediumCVSS 5.3No exploitEPSS 2%

    prosody · prosodyMay 13, 2021

  • CVE-2016-0756
    22Monitor

    The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialbac

    MediumCVSS 5.3No exploitEPSS 2%

    prosody · prosodyJan 29, 2016

  • CVE-2011-2205
    21Monitor

    Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service

    MediumCVSS 5.0No exploitEPSS 2%

    prosody · prosodyJun 22, 2011

  • CVE-2011-2532
    20Monitor

    The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite

    MediumCVSS 5.0No exploitEPSS 1%

    prosody · prosodyJun 22, 2011

  • CVE-2011-2531
    17Monitor

    Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remo

    MediumCVSS 4.3No exploitEPSS 1%

    prosody · prosodyJun 22, 2011