Citadel
by Citadel
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2004-1192 | 0.04 | — | 0.12 | Jan 10, 2005 | Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server. | |||
| CVE-2004-1705 | 0.03 | — | 0.05 | Jul 30, 2004 | Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username. | |||
| CVE-2023-44272 | 0.00 | — | 0.00 | Oct 4, 2023 | A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user. | |||
| CVE-2020-29547 | 0.00 | — | 0.01 | May 29, 2023 | An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure. | |||
| CVE-2011-1756 | 0.00 | — | 0.03 | Jun 21, 2011 | modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity… | |||
| CVE-2002-0432 | 0.00 | — | 0.06 | Jul 26, 2002 | Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server. |
- CVE-2004-1192Jan 10, 2005risk 0.04cvss —epss 0.12
Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via format string specifiers sent to the server.
- CVE-2004-1705Jul 30, 2004risk 0.03cvss —epss 0.05
Buffer overflow in Citadel/UX 6.23 and earlier allows remote attackers to cause a denial of service via a long username.
- CVE-2023-44272Oct 4, 2023risk 0.00cvss —epss 0.00
A cross-site scripting vulnerability exists in Citadel versions prior to 994. When a malicious user sends an instant message with some JavaScript code, the script may be executed on the web browser of the victim user.
- CVE-2020-29547May 29, 2023risk 0.00cvss —epss 0.01
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure.
- CVE-2011-1756Jun 21, 2011risk 0.00cvss —epss 0.03
modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity…
- CVE-2002-0432Jul 26, 2002risk 0.00cvss —epss 0.06
Buffer overflow in (1) lprintf and (2) cprintf in sysdep.c of Citadel/UX 5.90 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attacks such as a long HELO command to the SMTP server.