CVE-2022-0239

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

Oracle Business Intelligence Enterprise Edition (OAS 7.0) (July 2024 CPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory, including the following: - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of...

com.guokr:stan-cn-nlp (0.0.1), de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.distribution-gpl (1.4.0) +2 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (1.3.3)

edu.stanford.nlp:stanford-corenlp MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.guokr:stan-cn-nlp 0.0.1 -...

com.github.heideltime:heideltime (>=2.0.1, <=2.2.1), com.kennycason:fleschkincaid (1.0) +10 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.3.1)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.github.heideltime:heideltime =2.0.1, =0.0.2, =0.0.3, =2.0.0, =1.6.0, =3.1, =3.3 -...

com.bericotech:clavin-nerd (>=2.0.0rc1, <=2.1.0), com.cebglobal:xpresso (0.9.0) +14 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.4.1)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.bericotech:clavin-nerd =2.0.0rc1, =0.3.1, =0.9.0, =1.4, =1.4, =1.4, =1.4, =1.8, =1.7, =1....

com.articulatesoftware:sigma-component (>=2.09, <=2.10), com.github.helgeho:archivespark_2.11 (>=2.5, <=3.0.1) +9 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.5.1)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.articulatesoftware:sigma-component =2.09, =2.5, =5.1, =6.0.0, =5.6.0, =0.0.1, =1.3.3,...

com.github.hungntbka:htime (1.0), com.github.keenon:loglinear (>=1.2.5, <=1.2.10) +14 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.5.2)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.github.hungntbka:htime 1.0 - com.github.keenon:loglinear =1.2.5, =1.0, =4.8.7, =4.8.2,...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), com.github.jenshaase.uimascala:stanfordner_2.11 (0.6.1) +42 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.6.0)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - ae.teletronics.nlp:entityextraction =1.3, =0.1.0, =0.6.1, =2.0, =2.1 -...

com.github.mynlp:jigg (0.7.2), de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.corenlp-gpl (>=1.9.0, <=1.9.3) +43 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.8.0)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.github.mynlp:jigg 0.7.2 -...

com.github.funthomas424242:rades.tag-generator (1.0.0), de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.corenlp-gpl (1.10.0) +6 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (3.9.1)

edu.stanford.nlp:stanford-corenlp MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.github.funthomas424242:rades.tag-generator 1.0.0 -...

edu.washington.cs.knowitall.nlptools:nlptools-coref-stanford_2.9.2 (>=2.2.0, <=2.2.5), edu.washington.cs.knowitall.nlptools:nlptools-parse-stanford_2.9.2 (>=2.2.0, <=2.3.0) +2 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (1.3.2)

edu.stanford.nlp:stanford-corenlp MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - edu.washington.cs.knowitall.nlptools:nlptools-coref-stanford2.9.2 =2.2.0, =2.2.0, =2.2.0,...

edu.washington.cs.knowitall.nlptools:nlptools-coref-stanford_2.10 (2.4.1), edu.washington.cs.knowitall.nlptools:nlptools-coref-stanford_2.9.2 (>=2.3.0, <=2.4.1) +8 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (1.3.4)

edu.stanford.nlp:stanford-corenlp MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - edu.washington.cs.knowitall.nlptools:nlptools-coref-stanford2.10 2.4.1 -...

com.github.myedibleenso:processors-agiga_2.11 (>=0.0.1, <=0.0.2), edu.jhu.agiga:agiga (1.4) +14 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (1.3.5)

edu.stanford.nlp:stanford-corenlp MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on edu.stanford.nlp:stanford-corenlp and may be impacted: - com.github.myedibleenso:processors-agiga2.11 =0.0.1, =2.4.2, =2.4.2, =2.4.2, =2.4.2, =2.4.2,...

CVE-2022-0239

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

CVE-2022-0239

The CVE-2022-0239 entry pertains to Stanford CoreNLP (corenlp) with an XML External Entity (XXE) processing flaw. Root cause: SchemaFactory is created without secure processing enabled and is used to validate XML against a schema, enabling XXE when processing malicious XML. Impact (per public rec...

CVE-2022-0239 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

corenlp is vulnerable to Improper Restriction of XML External Entity Reference...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.tock:tock-nlp-model-stanford (>=19.9.0, <=22.3.2) +202 more potentially affected by CVE-2022-0239 via edu.stanford.nlp:stanford-corenlp (>=1.2.0, <=4.3.2)

edu.stanford.nlp:stanford-corenlp MAVEN version =1.2.0, =1.3, =19.9.0, =2.09, =2.7.3, =2.7.3, =2.7.3, =2.0.0rc1, =2.0.1, =2.5, =3.0.1 - com.github.hungntbka:htime 1.0 - com.github.jenshaase.uimascala:arktweetpostagger2.11 0.6.1 - com.github.jenshaase.uimascala:arktweettokenizer2.11 0.6.1 -...