CVE-2021-20464

IBM Cognos Analytics PowerPlay IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813...

Inline DTD allows XML bomb attack

The SweetXml aka sweetxml package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service resource consumption via an XML entity expansion attack with an inline DTD...

GHSA-QPMC-WPRV-X746 Inline DTD allows XML bomb attack

The SweetXml aka sweetxml package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service resource consumption via an XML entity expansion attack with an inline DTD...

GHSA-9GWX-9CWP-5C2M Billion laughs attack (XML bomb)

Impact Opencast is vulnerable to the Billion laughs attack which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast using a single HTTP request. Consider an XML file createMediaPackage.xml like this: xml mediapackage...

Billion laughs attack (XML bomb)

Impact Opencast is vulnerable to the Billion laughs attack which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast using a single HTTP request. Consider an XML file createMediaPackage.xml like this: xml mediapackage...

CVE-2021-32623 Opencast vulnerable to billion laughs attack (XML bomb)

Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a seemingly permanent denial of service attack, essentially taking down Opencast usin...

XML Entity Expansion (XEE)

Qt is is vulnerable to XML entity expansion. The vulnerability exists due to mishandling of 'QXmlStreamReader' allowing a malicious attacker to send crafted SVG to cause an xml bomb attack...

XML Entity Expansion

feedgen is vulnerable to XML entity expansion. The library allows parsing of XML content into existing XML tree, which would allow an attacker to perform an XML bomb attack resulting in excessive resource consumption leading to an application crash...

Feedgen Vulnerable to XML Denial of Service Attacks

Impact The feedgen library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks e.g. XML Bomb. This becomes a concern in particular if feedge...

WSSAT - Web Service Security Assessment Tool

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

CVE-2016-8275

Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

CVE-2016-8275

Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

Design/Logic Flaw

Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

CVE-2016-8275

CVE-2016-8275 affects Huawei AnyOffice, specifically the AnyOffice EMM component on the V200R006C00 platform. The vulnerability allows an authenticated remote attacker to cause a denial of service by uploading an XML bomb, enabling partial availability impact as described in the NVD entry. The is...

CVE-2016-8275

Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

Huawei AnyOffice XML Bomb Vulnerability

AnyOffice provides Enterprise Mobile Management EMM function to manage the whole life cycle of mobile devices. An XML Bomb vulnerability exists in AnyOffice EMM, which can be exploited by an authenticated network attacker to cause a denial of service by uploading an XML bomb...

WSSAT - Web Service Security Assessment Tool

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

Security Advisory - XML Bomb Vulnerability in AnyOffice

AnyOffice Enterprise Mobile Management EMM is a module of the AnyOffice, which provides the mobile terminal management function. The XML Bomb vulnerability in the AnyOffice EMM could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...

Damn Vulnerable Web Services: DVWS

Damn Vulnerable Web Services is a vulnerable testing environment that can be used to learn real world web service vulnerabilities. The aim of this project is to aid security professionals in testing their skills and tools in a legal environment. This application is designed to understand the...

Updated springframework package fixes security vulnerability

In Spring Framework before 3.2.14, if DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protec...