ejabberd -- Multiple security vulnerabilities

ejabberd team reports:

• It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.
• mod_caps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.
• SQL injection in mod_pubsub handling of paging requests.
• Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api.
• It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db.
• using ejabberd as OAuth provider will be only allowed by clients
• that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.
• Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.
• Files server by mod_http_upload didn't have XSS prevention headers.
• Issues in authentication of SIP requests.
• Request to web_admin were lacking CSRF protection.
• It was possible to skip captcha verification in mod_register_web.
• mod_conversejs allowed putting unescaped value from url in page content.

[source]