External XML Entity (XXE) Attacks

ignite-core is vulnerable external XML entity XXE attacks. The update notifier component sends sensitive system data over an unsecured HTTP connection. Since TLS is not used man-in-the-middle MitM attacks also possible. Attackers can alter the response coming from the server the information is se...

IBM Jazz Foundation External Entity Injection Vulnerability

IBM Jazz Foundation is a scalable and extensible team collaboration platform that integrates tasks across the software lifecycle, and which provides useful building blocks and frameworks that help develop new products and tools. IBM Jazz Foundation suffers from an XML External Entity Injection XX...

CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

Design/Logic Flaw

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

DEBIAN-CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

UBUNTU-CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

CVE-2017-5644

CVE-2017-5644 affects Apache POI: versions prior to 3.15 are vulnerable to an XML Entity Expansion (XEE) denial of service via a specially crafted OOXML file, causing high CPU usage. Documented impact is a CPU consumption DoS rather than code execution. Public references in the connected material...

CVE-2017-5644

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

Pidgin < 2.12.0 libpurple/util.c purple_markup_unescape_entity() XML Entity Handling RCE

The version of Pidgin installed on the remote Windows host is prior to 2.12.0. It is, therefore, affected by a remote code execution vulnerability in the libpurple library in util.c due to an out-of-bounds writer error in the purplemarkupunescapeentity function that is triggered when handling...

Denial Of Service (DoS) Via XML External Expansion (XEE)

poi-ooxml is vulnerable to denial of service DoS attacks. The vulnerability exists via an XML Entity Expansion XEE attack when parsing a malicious OOXML file...

CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

Design/Logic Flaw

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

CVE-2016-4931

XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service...

CVE-2016-4931

CVE-2016-4931 affects Juniper Networks Junos Space prior to 15.2R2. The issue is an XML External Entity (XXE) injection in the product, allowing an attacker to trigger a denial of service. Public records consistently describe the vulnerability as an XML entity injection that can cause service dis...

XML Entity Expansion (XEE)

Jersey common is vulnerable to billion laugh attacks. These attacks are possible because it does not disable XML Entity Expansion XEE...

Denial Of Service (DoS) Via Billion Laugh Attack

resteasy is vulnerable to XML entity denial-of-service DoS, also known as billion laugh attacks. The attacks are possible because it bypasses the entity expansion limit set by JAXP when XXE is disabled...