MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associa…
CVSS 3.1HIGH 7.4·Network·No auth·No interaction·EPSS 0.04512·Published 2020-02-06·Fixed in 1.0.4CWE-269
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display.
