ejabberd -- Multiple security vulnerabilities

ejabberd team reports:

• Unauthenticated Remote Code Execution on ejabberd (reported by Gia Bui) when:
  • ejabberd versions is at least 25.10
  • BOSH is enabled on any port
  • S2S is enabled
  • mod_adhoc_api is loaded
  • outbound connectivity from ejabberd on ports epmd (default 4369), s2s (default 5269) and Erlang distribution port (dynamically assigned, typically in the range 49152-65535 unless FIREWALL_WINDOW is set in ejabberdctl.cfg).
• DoS attack on 16.12+ versions if BOSH is enabled on any port.
• Cross-Tenant MUC, Roster and Shared-Roster unauthorized access (reported by Hoang Gia).

[source]