XML External Entity (XXE)

jersey-core is vulnerable to XML external entity attacks. The external parameter entities were not disabled by the jersey SAX parser, allowing a remote attacker to exploit the vulnerability to read files accessible to the user running the application server, and potentially perform recursive enti...

Billion laughs attack in c3p0

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

GHSA-84P2-VF58-XHXV Billion laughs attack in c3p0

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

Design/Logic Flaw

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

UBUNTU-CVE-2019-5427

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

CVE-2019-5427

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

CVE-2019-5427

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

CVE-2019-5427: Improper Restriction of Recursive Entity References in DTDs

c3p0 version 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration...

Oracle Linux 5 : libxml2 (ELSA-2014-1885)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1885 advisory. - CVE-2014-3660 denial of service via recursive entity expansion rhbz1161841 Tenable has extracted the preceding description block directly from the Oracle Linu...

Oracle Linux 6 / 7 : libxml2 (ELSA-2014-1655)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1655 advisory. 2.9.1-5.0.1.el70.1 - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball 2.9.1-5.1 - CVE-2014-3660 denial of...

libxml2: denial of service via recursive entity expansion

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption denial of service bas...

libxml2 security update

2.9.1-5.0.1.el70.1 - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball 2.9.1-5.1 - CVE-2014-3660 denial of service via recursive entity expansion rhbz1149087...

CVE-2013-1864

Removed by vendor...

CVE-2011-3288: Improper Restriction of Recursive Entity References in DTDs

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

JBossWS remote Denial of Service

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterpris...

CVE-2008-3281: Improper Restriction of Recursive Entity References in DTDs

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document...