Ejabberd
Vendor:
First CVE: May 5, 2006 · Active for 20 years
8
Total CVEs
More Total CVEs than 85% of tracked products
1.0
Avg CVEs / Year
Bottom 1%
5.0
Avg CVSS
Higher Avg CVSS than 7% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ejabberd over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 5, 2006
20 years ago
Most Recent CVE
Oct 25, 2014
4,290 days ago
CVE Severity & Scoring
Ejabberd8 CVEs
13%
75%
13%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown8 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown8 (100.0%)
User Interaction
None0 (0.0%)
Unknown8 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown8 (100.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-0903HIGH Unspecified vulnerability in the mod_roster_odbc module in ejabberd before 1.1.3 has unknown impact and attack vectors. | Feb 13, 2007 | 10.0 | 25 | NO | NO |
CVE-2011-1753MEDIUM expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers | Jun 21, 2011 | 5.0 | 19 | NO | NO |
CVE-2011-4320MEDIUM The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publis | Feb 18, 2012 | 4.0 | 17 | NO | NO |
CVE-2010-0305MEDIUM ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a | Feb 3, 2010 | 5.0 | 17 | NO | NO |
CVE-2014-8760MEDIUM ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption. | Oct 25, 2014 | 5.0 | 15 | NO | NO |
CVE-2013-6169MEDIUM The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force a | Oct 17, 2013 | 4.3 | 14 | NO | NO |
CVE-2009-0934MEDIUM Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs. | Mar 18, 2009 | 4.3 | 14 | NO | NO |
A third-party installer generation tool, possibly BitRock InstallBuilder, as used in products including Process-one ejabberd 1.1.1_1 and earlier, generates an installer that allows | May 5, 2006 | 2.1 | 11 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Ejabberd
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.0.0 | 2 | 4.7 | 2.1% | 0 | 0 |
| 2.1.9 | 1 | 4.3 | 1.6% | 0 | 0 |
| 2.1.8 | 2 | 4.2 | 1.8% | 0 | 0 |
| 2.1.7 | 1 | 4.3 | 1.6% | 0 | 0 |
| 2.1.6 | 1 | 4.3 | 1.6% | 0 | 0 |
| 2.1.5 | 2 | 4.7 | 1.9% | 0 | 0 |
| 2.1.4 | 2 | 4.7 | 1.9% | 0 | 0 |
| 2.1.3 | 2 | 4.7 | 1.9% | 0 | 0 |
| 2.1.2 | 2 | 4.7 | 1.9% | 0 | 0 |
| 2.1.11 | 1 | 4.3 | 1.6% | 0 | 0 |
| 2.1.10 | 1 | 4.3 | 1.6% | 0 | 0 |
| 2.1.1 | 3 | 4.8 | 2.3% | 0 | 0 |
| 2.1.0 | 3 | 4.8 | 2.3% | 0 | 0 |
| 2.0.5 | 3 | 4.8 | 2.3% | 0 | 0 |
| 2.0.4 | 3 | 4.8 | 2.3% | 0 | 0 |
| 2.0.3 | 3 | 4.8 | 2.3% | 0 | 0 |
| 2.0.2 | 4 | 4.7 | 2.1% | 0 | 0 |
| 2.0.1_2 | 4 | 4.7 | 2.1% | 0 | 0 |
| 2.0.0 | 4 | 4.7 | 2.1% | 0 | 0 |
| 1.1.3 | 4 | 4.7 | 2.1% | 0 | 0 |