CVE-2016-4434

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

CVE-2016-4434

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

CVE-2016-4434

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

CVE-2016-4434

CVE-2016-4434 (Apache Tika) affects Tika prior to 1.13, where improper initialization of the XML parser/handlers enables XML External Entity (XXE) attacks via OOXML spreadsheets and XMP metadata in PDFs and other formats. The root cause is an XXE vulnerability in XML parsing that can lead to read...

Apache Commons Jelly connects to url with certain custom doctype definitions.

Severity: Medium Vendor: The Apache Software Foundation Versions Affected: commons-jelly-1.0 core, namely commons-jelly-1.0.jar Description: During jelly xml file parsing with xerces, if a custom doctype entity is declared with a ?SYSTEM? entity with a url and that entity is used in the body of t...

PT-2017-3830

Name of the Vulnerable Software and Affected Versions Apache Solr versions prior to 5.5.5 Apache Solr versions prior to 6.6.2 Apache Solr versions prior to 7.1.0 Apache Lucene versions prior to 7.1.0 Description The issue is related to the incorrect restriction of XML external entity references i...

Microsoft Office Outlook Denial of Service Vulnerability

Microsoft Office Outlook is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Office Outlook Denial of Service Vulnerability - Mac OS X

Microsoft Office Outlook is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of the XML parser in the SAP NetWeaver software integration platform allows a hacker to read arbitrary files or cause service failures.

The vulnerability of the XML parser in the SAP NetWeaver software integration platform arises from an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files or cause service failures...

CVE-2016-5795

An XXE issue was discovered in Automated Logic Corporation ALC Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser...

Design/Logic Flaw

An XXE issue was discovered in Automated Logic Corporation ALC Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser...

CVE-2016-5795

This CVE (CVE-2016-5795) affects Automated Logic Corporation WebCTRL, Liebert SiteScan Web (6.5 and earlier), and Carrier i-Vu (6.5 and earlier). Root cause: improper XML parsing configuration allowing XML External Entity (XXE) processing to be exploited via a weakly configured XML parser, enabli...

OpenJDK: insecure XML parsing in wsdlimport (JAX-WS, 8182054)

It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak...

Apache Xerces-C++ Denial of Service Vulnerability

Apache Xerces is an XML syntax parser from the Apache Software Foundation.Apache Xerces-C++ is the language version. A security vulnerability exists in Apache Xerces-C++. A remote attacker can exploit this vulnerability by sending a specially crafted message to the XML service to cause a denial o...

DEBIAN-CVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...

CVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...

CVE-2017-9233

CVE-2017-9233: XML External Entity DoS in libexpat 2.2.0 and earlier via malformed external entity in an external DTD. Affected: libexpat (Expat XML Parser Library). Impact: parser denial-of-service (infinite loop). Remediation: update to libexpat 2.2.1 (fixes addressed in advisories). If impleme...

CVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...

PSF-2017-7 Expat 2.2.1

XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...

CVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD...