CVE-2021-37601

muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.

• http://www.openwall.com/lists/oss-security/2021/07/28/4Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBBKDIHO27DY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4AGH4IR7O2/
• https://prosody.im/Exploit, Product
• https://prosody.im/security/advisory_20210722/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2021/07/28/4Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BZRRPCNOETB4MN4XSYPRBBKDIHO27DY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EMKIOEP2CYWHVVUCNWISPE4AGH4IR7O2/
• https://prosody.im/Exploit, Product
• https://prosody.im/security/advisory_20210722/Vendor Advisory

Published

Jul 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37596Telegram Web K Alpha 0.6.1 allows XSS via a document name.6.1
• CVE-2021-37597WP Cerber before 8.9.3 allows MFA bypass via wordpress_logge…9.8
• CVE-2021-37598WP Cerber before 8.9.3 allows bypass of /wp-json access cont…5.3
• CVE-2021-37599The exporter/Login.aspx login form in the Exporter in Nuance…9.8
• CVE-2021-3760A flaw was found in the Linux kernel. A use-after-free vulne…7.8
• CVE-2021-37600An integer overflow in util-linux through 2.37.1 can potenti…5.5
• CVE-2021-37604In version 6.5 of Microchip MiWi software and all previous v…7.5
• CVE-2021-37605In version 6.5 Microchip MiWi software and all previous vers…7.5
• CVE-2021-37606Meow hash 0.5/calico does not sufficiently thwart key recove…5.3
• CVE-2021-37608Unrestricted Upload of File with Dangerous Type vulnerabilit…9.8
• CVE-2021-3761Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 …7.5
• CVE-2021-37613Stormshield Network Security (SNS) 1.0.0 through 4.2.3 allow…6.5