An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display.
CVSS 3.0MEDIUM 5.9·Network·No auth·No interaction·EPSS 0.0094·Published 2017-02-09·Fixed in 1.0.7, 2.0.5CWE-20
Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended.
CVSS 3.0MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.01084·Published 2018-02-19·Fixed in 3.3.3CWE-200
