XML External Entity Reference in edu.stanford.nlp:stanford-corenlp

2022-01-1421:07:23

Google

osv.dev

0.001 Low

EPSS

Percentile

32.1%

JSON

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

CPENameOperatorVersion
edu.stanford.nlp:stanford-corenlpeq3.5.0
edu.stanford.nlp:stanford-corenlpeq3.3.0
edu.stanford.nlp:stanford-corenlpeq3.2.0
edu.stanford.nlp:stanford-corenlpeq1.3.1
edu.stanford.nlp:stanford-corenlpeq1.3.3
edu.stanford.nlp:stanford-corenlpeq3.4
edu.stanford.nlp:stanford-corenlpeq1.2.0
edu.stanford.nlp:stanford-corenlpeq3.4.1
edu.stanford.nlp:stanford-corenlpeq4.2.0
edu.stanford.nlp:stanford-corenlpeq1.3.4

Name	Operator	Version
edu.stanford.nlp:stanford-corenlp	eq	3.5.0
edu.stanford.nlp:stanford-corenlp	eq	3.3.0
edu.stanford.nlp:stanford-corenlp	eq	3.2.0
edu.stanford.nlp:stanford-corenlp	eq	1.3.1
edu.stanford.nlp:stanford-corenlp	eq	1.3.3
edu.stanford.nlp:stanford-corenlp	eq	3.4
edu.stanford.nlp:stanford-corenlp	eq	1.2.0
edu.stanford.nlp:stanford-corenlp	eq	3.4.1
edu.stanford.nlp:stanford-corenlp	eq	4.2.0
edu.stanford.nlp:stanford-corenlp	eq	1.3.4