CVE-2021-20464: Improper Restriction of Recursive Entity References in DTDs

IBM Cognos Analytics PowerPlay IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813...

XML2Dict XML Entity Expansion Vulnerability

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references...

CVE-2021-32623: Improper Restriction of Recursive Entity References in DTDs

Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast usin...

CVE-2021-1267: Improper Restriction of Recursive Entity References in DTDs

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

CVE-2020-2172: Improper Restriction of Recursive Entity References in DTDs

Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2012-6685: Improper Restriction of Recursive Entity References in DTDs

Nokogiri before 1.5.4 is vulnerable to XXE attacks...

CVE-2014-2228: Improper Restriction of Recursive Entity References in DTDs

The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages...

CVE-2013-4335: Improper Restriction of Recursive Entity References in DTDs

opOpenSocialPlugin 0.8.2.1, 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities...

CVE-2020-6856: Improper Restriction of Recursive Entity References in DTDs

An XML External Entity XEE vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders...

CVE-2013-6461: Improper Restriction of Recursive Entity References in DTDs

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

CVE-2011-1755: Improper Restriction of Recursive Entity References in DTDs

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564...

CVE-2009-1955: Improper Restriction of Recursive Entity References in DTDs

The expat XML parser in the aprxml interface in xml/aprxml.c in Apache APR-util before 1.3.7, as used in the moddav and moddavsvn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service memory consumption via a crafted XML document containing a large number of nest...