Lucene search
GoogleOSV:GHSA-JWWR-FJGH-CV2XHistoryMay 13, 2022 - 1:05 a.m.
Improper Restriction of XML External Entity Reference in Castor
2022-05-1301:05:37
Google
osv.dev
9
0.016 Low
EPSS
Percentile
87.6%
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
References
lists.opensuse.org/opensuse-updates/2014-06/msg00043.html
packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html
seclists.org/fulldisclosure/2014/May/142
nvd.nist.gov/vuln/detail/CVE-2014-3004
quickview.cloudapps.cisco.com/quickview/bug/CSCvm56811
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpuoct2021.html
Related
packetstorm
packetstorm
Castor Library XXE Disclosure
2014-05-30 00:00:00
Cisco WebEx Meetings Server XML Injection
2018-11-05 00:00:00
ibm
ibm
Security Bulletin: XML External Entity Processing in Castor might affect WebSphere Lombardi Edition (CVE-2014-3004)
2018-06-15 07:02:08
cvelist
cvelist
CVE-2014-3004
2014-06-11 14:00:00
github
github
Improper Restriction of XML External Entity Reference in Castor
2022-05-13 01:05:37
openvas
openvas
Fedora Update for castor FEDORA-2014-16346
2014-12-15 00:00:00
Fedora Update for castor FEDORA-2014-16446
2015-01-05 00:00:00
Mageia: Security Advisory (MGASA-2014-0556)
2022-01-28 00:00:00
mageia
mageia
Updated castor packages fix CVE-2014-3004
2014-12-31 15:28:04
cve
cve
CVE-2014-3004
2014-06-11 14:55:07
CVE-2018-18895
2019-02-12 18:00:00
nessus
nessus
Fedora 21 : castor-1.3.3-1.fc21 (2014-16446)
2014-12-15 00:00:00
Fedora 20 : castor-1.3.3-1.fc20 (2014-16346)
2014-12-15 00:00:00
openSUSE Security Update : castor (openSUSE-SU-2014:0822-1)
2014-06-23 00:00:00
prion
prion
Xxe
2014-06-11 14:55:00
nvd
nvd
CVE-2014-3004
2014-06-11 14:55:07
CVE-2018-18895
2019-01-30 15:29:05
symantec
symantec
fedora
fedora
[SECURITY] Fedora 21 Update: castor-1.3.3-1.fc21
2014-12-15 04:35:34
[SECURITY] Fedora 20 Update: castor-1.3.3-1.fc20
2014-12-15 04:35:59
ubuntucve
ubuntucve
CVE-2014-3004
2014-06-11 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2020
2020-01-14 00:00:00