Security Bulletin: Apache POI up to 4.1.0 allows an attacker while converting user-provided document to XML

Summary In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker​​. Vulnerability Details CVEID:CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in Apache POI affect Asset and Service Management

Summary There are multiple vulnerabilities in Apache POI that are used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions including Maximo for Aviation, Maximo for Government, Maximo for Nuclear Power, Maximo...

Security Bulletin: A security vulnerability has been identified in Apache POI shipped with IBM Tivoli Netcool Impact (CVE-2019-12415)

Summary Apache POI is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting Apache POI has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-12415 DESCRIPTION: Apache POI could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: A security vulnerability has been identified in Apache poi-scratchpad shipped with IBM Tivoli Netcool Impact (CVE-2022-26336)

Summary Apache poi-scratchpad is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting Apache poi-scratchpad has been published in a security bulletin. Vulnerability Details CVEID: CVE-2022-26336 DESCRIPTION: Apache POI is vulnerable to a denial of service,...

ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), ai.stainless:grails-tika (=0.1.0) +5788 more potentially affected by CVE-2019-12415 via org.apache.poi:poi (>=3.0-FINAL <=4.1.0)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.3, =1.10.2, =1.13.0, =1.2.0, =1.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2019-12415 Source advisory: OSV:GHSA-9JWC-Q6J3-8G9G...

Improper Restriction of XML External Entity Reference in Apache POI

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity XXE Processing...

be.thematchbox:AbstractRiver (>=1.0.1 <=1.1.0), br.com.starcode.trex:t-rex (=0.7.1) +408 more potentially affected by CVE-2014-9527 via org.apache.poi:poi (>=3.0-FINAL <=3.10.1)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.0.1, =0.1, =0.1, =1.0.4, =5.0.1.1, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.6.4 and more Source cves: CVE-2014-9527 Source advisory: OSV:GHSA-X9MM-6GPF-F749...

Loop with Unreachable Exit Condition in Apache POI

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

GHSA-X9MM-6GPF-F749 Loop with Unreachable Exit Condition in Apache POI

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

be.thematchbox:AbstractRiver (>=1.0.1 <=1.1.0), br.com.starcode.trex:t-rex (=0.7.1) +319 more potentially affected by CVE-2014-3529 via org.apache.poi:poi (>=3.0-FINAL <=3.10-beta2)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.0.1, =1.0.4, =5.0.1.1, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.6.4 and more Source cves: CVE-2014-3529 Source advisory: OSV:GHSA-Q56H-JJJ6-52MF...

Improper Restriction of XML External Entity Reference in Apache POI

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

GHSA-Q56H-JJJ6-52MF Improper Restriction of XML External Entity Reference in Apache POI

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

be.thematchbox:AbstractRiver (>=1.0.1 <=1.1.0), br.com.starcode.trex:t-rex (=0.7.1) +319 more potentially affected by CVE-2014-3574 via org.apache.poi:poi (>=3.0-FINAL <=3.10-beta2)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.0.1, =1.0.4, =5.0.1.1, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.0.2, =5.6.4 and more Source cves: CVE-2014-3574 Source advisory: OSV:GHSA-5WFP-8643-C58X...

Improper Input Validation in Apache POI

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service CPU consumption and crash via a crafted OOXML file, aka an XML Entity Expansion XEE attack...

GHSA-5WFP-8643-C58X Improper Input Validation in Apache POI

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service CPU consumption and crash via a crafted OOXML file, aka an XML Entity Expansion XEE attack...

GHSA-PMQQ-7WFV-JFFF Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

ae.teletronics.nlp:entityextraction (>=1.3 <=1.4), at.iem:sysson_2.10 (=1.12.0) +1672 more potentially affected by CVE-2017-5644 via org.apache.poi:poi (>=3.0-FINAL <=3.14-beta1)

org.apache.poi:poi MAVEN version =3.0-FINAL, =1.3, =1.10.2, =1.0.1, =1.1.8, =2.23.5, =2.23.5, =19.1.0, =2.23.5, =2.23.5, =20.3.0, =2.23.5, =2.23.5, =20.2.0 and more Source cves: CVE-2017-5644 Source advisory: OSV:GHSA-78VV-QJ73-H9M5...

GHSA-78VV-QJ73-H9M5 Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...