Process One maintains a narrow product line focused on messaging infrastructure, centered on ejabberd, a widely deployed open-source XMPP (Jabber) server used for real-time communication systems. The vulnerability footprint reflects the demands of protocol implementation and network service exposure inherent to messaging platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Process One over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-0903HIGH Unspecified vulnerability in the mod_roster_odbc module in ejabberd before 1.1.3 has unknown impact and attack vectors. | Feb 13, 2007 | 10.0 | 25 | NO | NO |
CVE-2011-1753MEDIUM expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers | Jun 21, 2011 | 5.0 | 19 | NO | NO |
CVE-2011-4320MEDIUM The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publis | Feb 18, 2012 | 4.0 | 17 | NO | NO |
CVE-2010-0305MEDIUM ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a | Feb 3, 2010 | 5.0 | 17 | NO | NO |
CVE-2014-8760MEDIUM ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption. | Oct 25, 2014 | 5.0 | 15 | NO | NO |
CVE-2013-6169MEDIUM The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force a | Oct 17, 2013 | 4.3 | 14 | NO | NO |
CVE-2009-0934MEDIUM Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs. | Mar 18, 2009 | 4.3 | 14 | NO | NO |
A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.1_1 and earlier, generates an installer that allows | May 5, 2006 | 2.1 | 11 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Process One.
Media articles that mention a CVE ID that affects a product developed by Process One — matched by CVE ID, not by vendor name.