Igniterealtime Smack vulnerabilities

3 vulnerabilities

Known vulnerabilities in Igniterealtime Smack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.9CVE-2016-10027fedoraprojectfedora+2
EPSS score
1.51%
Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.5CVE-2014-0364igniterealtimesmack
EPSS score
6.24%
The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.5.8CVE-2014-0363igniterealtimesmack
EPSS score
1.23%
The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.