CVE-2014-0364

The ParseRoster component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify the from attribute of a roster-query IQ stanza, which allows remote attackers to spoof IQ responses via a crafted attribute.

• CWE-345

• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-releasedVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1176.htmlThird Party Advisory
• http://secunia.com/advisories/59290Third Party Advisory
• http://secunia.com/advisories/59291Third Party Advisory
• http://www.kb.cert.org/vuls/id/489228Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/67124Third Party Advisory, VDB Entry
• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-releasedVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1176.htmlThird Party Advisory
• http://secunia.com/advisories/59290Third Party Advisory
• http://secunia.com/advisories/59291Third Party Advisory
• http://www.kb.cert.org/vuls/id/489228Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/67124Third Party Advisory, VDB Entry

Published

Apr 30, 2014

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0358Multiple directory traversal vulnerabilities in Xangati XSR …
• CVE-2014-0359Xangati XSR before 11 and XNR before 7 allows remote attacke…
• CVE-2014-0360Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0361The default configuration of IBM 4690 OS, as used in Toshiba…
• CVE-2014-0362Cross-site scripting (XSS) vulnerability on Google Search Ap…
• CVE-2014-0363The ServerTrustManager component in the Ignite Realtime Smac…
• CVE-2014-0366Unspecified vulnerability in the Oracle Applications Framewo…
• CVE-2014-0367Unspecified vulnerability in the Hyperion Essbase Administra…
• CVE-2014-0368Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, an…
• CVE-2014-0369Unspecified vulnerability in the Siebel Core - EAI component…
• CVE-2014-0370Unspecified vulnerability in the Siebel Life Sciences compon…
• CVE-2014-0371Unspecified vulnerability in the Oracle Demantra Demand Mana…