It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

USN-8984-1: jabberd2 vulnerability

VERWANDTEARTIKEL

CVE-2026-120955 - MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

CVE-2026-120678 - mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

CVE-2026-63494 - AVideo OS Command Injection Vulnerability

CVE-2026-44267 - Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

CVE-2026-63492 - AVideo OS Command Injection

CVE-2026-44266 - Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels