CVE-2022-20917

MEDIUM Year: 2022
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-668
View all →

Vulnerability Description

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.

Related Vulnerabilities

CVE-2019-10365

MEDIUM
CVSS:4.3(Medium)

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permi...

CWE-6682019

CVE-2019-16518

MEDIUM
CVSS:4.3(Medium)

An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger an unintended temperature in the victim's mouth and throat via Bluetooth Low Energ...

CWE-6682019

CVE-2020-26086

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an ...

CWE-6682020

CVE-2020-4989

MEDIUM
CVSS:4.3(Medium)

IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive information about build definitions. IBM...

CWE-6682020

CVE-2020-6442

MEDIUM
CVSS:4.3(Medium)

Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CWE-6682020

CVE-2020-6490

MEDIUM
CVSS:4.3(Medium)

Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin data via a crafted HTML page.

CWE-6682020