Lucene search
HistoryAug 18, 2014 - 11:15 a.m.
CVE-2014-5265
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7 High
AI Score
Confidence
High
0.436 Medium
EPSS
Percentile
97.4%
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected configurations
Node
wordpresswordpressRange≤3.9.1
ORwordpresswordpressMatch3.0
ORwordpresswordpressMatch3.0.1
ORwordpresswordpressMatch3.0.2
ORwordpresswordpressMatch3.0.3
ORwordpresswordpressMatch3.0.4
ORwordpresswordpressMatch3.0.5
ORwordpresswordpressMatch3.0.6
ORwordpresswordpressMatch3.1
ORwordpresswordpressMatch3.1.1
ORwordpresswordpressMatch3.1.2
ORwordpresswordpressMatch3.1.3
ORwordpresswordpressMatch3.1.4
ORwordpresswordpressMatch3.2
ORwordpresswordpressMatch3.2beta1
ORwordpresswordpressMatch3.2.1
ORwordpresswordpressMatch3.3
ORwordpresswordpressMatch3.3.1
ORwordpresswordpressMatch3.3.2
ORwordpresswordpressMatch3.3.3
ORwordpresswordpressMatch3.4.0
ORwordpresswordpressMatch3.4.1
ORwordpresswordpressMatch3.4.2
ORwordpresswordpressMatch3.5.0
ORwordpresswordpressMatch3.5.1
ORwordpresswordpressMatch3.6
ORwordpresswordpressMatch3.6.1
ORwordpresswordpressMatch3.7
ORwordpresswordpressMatch3.7.1
ORwordpresswordpressMatch3.8
ORwordpresswordpressMatch3.8.1
ORwordpresswordpressMatch3.9.0
Node
drupaldrupalMatch6.0
ORdrupaldrupalMatch6.0beta1
ORdrupaldrupalMatch6.0beta2
ORdrupaldrupalMatch6.0beta3
ORdrupaldrupalMatch6.0beta4
ORdrupaldrupalMatch6.0dev
ORdrupaldrupalMatch6.0rc1
ORdrupaldrupalMatch6.0rc2
ORdrupaldrupalMatch6.0rc3
ORdrupaldrupalMatch6.0rc4
ORdrupaldrupalMatch6.1
ORdrupaldrupalMatch6.2
ORdrupaldrupalMatch6.3
ORdrupaldrupalMatch6.4
ORdrupaldrupalMatch6.5
ORdrupaldrupalMatch6.6
ORdrupaldrupalMatch6.7
ORdrupaldrupalMatch6.8
ORdrupaldrupalMatch6.9
ORdrupaldrupalMatch6.10
ORdrupaldrupalMatch6.11
ORdrupaldrupalMatch6.12
ORdrupaldrupalMatch6.13
ORdrupaldrupalMatch6.14
ORdrupaldrupalMatch6.15
ORdrupaldrupalMatch6.16
ORdrupaldrupalMatch6.17
ORdrupaldrupalMatch6.18
ORdrupaldrupalMatch6.19
ORdrupaldrupalMatch6.20
ORdrupaldrupalMatch6.21
ORdrupaldrupalMatch6.22
ORdrupaldrupalMatch6.23
ORdrupaldrupalMatch6.24
ORdrupaldrupalMatch6.25
ORdrupaldrupalMatch6.26
ORdrupaldrupalMatch6.27
ORdrupaldrupalMatch6.28
ORdrupaldrupalMatch6.29
ORdrupaldrupalMatch6.30
ORdrupaldrupalMatch6.31
ORdrupaldrupalMatch6.32
ORdrupaldrupalMatch7.0
ORdrupaldrupalMatch7.0alpha1
ORdrupaldrupalMatch7.0alpha2
ORdrupaldrupalMatch7.0alpha3
ORdrupaldrupalMatch7.0alpha4
ORdrupaldrupalMatch7.0alpha5
ORdrupaldrupalMatch7.0alpha6
ORdrupaldrupalMatch7.0alpha7
ORdrupaldrupalMatch7.0beta1
ORdrupaldrupalMatch7.0beta2
ORdrupaldrupalMatch7.0beta3
ORdrupaldrupalMatch7.0dev
ORdrupaldrupalMatch7.0rc1
ORdrupaldrupalMatch7.0rc2
ORdrupaldrupalMatch7.0rc3
ORdrupaldrupalMatch7.0rc4
ORdrupaldrupalMatch7.1
ORdrupaldrupalMatch7.2
ORdrupaldrupalMatch7.3
ORdrupaldrupalMatch7.4
ORdrupaldrupalMatch7.5
ORdrupaldrupalMatch7.6
ORdrupaldrupalMatch7.7
ORdrupaldrupalMatch7.8
ORdrupaldrupalMatch7.9
ORdrupaldrupalMatch7.10
ORdrupaldrupalMatch7.11
ORdrupaldrupalMatch7.12
ORdrupaldrupalMatch7.13
ORdrupaldrupalMatch7.14
ORdrupaldrupalMatch7.15
ORdrupaldrupalMatch7.16
ORdrupaldrupalMatch7.17
ORdrupaldrupalMatch7.18
ORdrupaldrupalMatch7.19
ORdrupaldrupalMatch7.20
ORdrupaldrupalMatch7.21
ORdrupaldrupalMatch7.22
ORdrupaldrupalMatch7.23
ORdrupaldrupalMatch7.24
ORdrupaldrupalMatch7.25
ORdrupaldrupalMatch7.26
ORdrupaldrupalMatch7.27
ORdrupaldrupalMatch7.28
ORdrupaldrupalMatch7.29
ORdrupaldrupalMatch7.30
ORdrupaldrupalMatch7.x-dev
Node
debiandebian_linuxMatch7.0
Related
ubuntucve
ubuntucve
prion
prion
Design/Logic Flaw
2014-08-18 11:15:00
Design/Logic Flaw
2016-01-03 05:59:00
Code injection
2014-09-23 20:55:00
cvelist
cvelist
debiancve
debiancve
cve
cve
nvd
nvd
patchstack
patchstack
WordPress <= 3.9.1 - Denial Of Service Attacks #2
2014-08-15 00:00:00
checkpoint_advisories
checkpoint_advisories
nessus
nessus
RHEL 2.1 : libxml2 (RHSA-2008:0886)
2008-09-12 00:00:00
EulerOS 2.0 SP2 : qt (EulerOS-SA-2020-1669)
2020-06-17 00:00:00
openSUSE 15 Security Update : snakeyaml (openSUSE-SU-2021:1876-1)
2021-07-16 00:00:00
openvas
openvas
FreeBSD Ports: ejabberd
2011-08-03 00:00:00
CentOS Update for libxml2 CESA-2008:0886-01 centos2 i386
2009-02-27 00:00:00
Huawei EulerOS: Security Advisory for qt (EulerOS-SA-2020-1431)
2020-04-16 00:00:00
github
github
SnakeYAML Entity Expansion during load operation
2021-06-04 21:37:45
JBossWS vulnerable to uncontrolled recursion
2022-05-13 01:39:29
osv
osv
JBossWS vulnerable to uncontrolled recursion
2022-05-13 01:39:29
CVE-2017-18640
2019-12-12 03:15:10
SnakeYAML Entity Expansion during load operation
2021-06-04 21:37:45
veracode
veracode
Denial Of Service (DoS)
2019-01-15 08:53:01
freebsd
freebsd
ejabberd -- remote denial of service vulnerability
2011-04-27 00:00:00
centos
centos
libxml2 security update
2008-09-12 01:23:56
redhatcve
redhatcve
CVE-2017-18640
2020-04-08 21:02:33
redhat
redhat
(RHSA-2008:0886) Important: libxml2 security update
2008-09-11 00:00:00
drupal
drupal
SA-CORE-2014-004 - Drupal core - Denial of service
2014-08-06 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: drupal7-7.31-1.fc19
2014-08-21 09:41:54
[SECURITY] Fedora 20 Update: drupal6-6.33-1.fc20
2014-09-26 09:05:28
[SECURITY] Fedora 20 Update: drupal7-7.31-1.fc20
2014-08-21 09:45:41
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7 High
AI Score
Confidence
High
0.436 Medium
EPSS
Percentile
97.4%
Related for NVD:CVE-2014-5265